Path traversal in node-tar - CVE-2026-23745

Vulnerability identifier: #VU121640

CSH Severity: Medium

CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-23745

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences in src/unpack.ts within the [HARDLINK] and [SYMLINK] methods. A remote attacker can send a specially crafted HTTP request and read/overwrite arbitrary files on the system.

node-tar
Voice Gateway
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
Jira Service Management Data Center
Confluence Data Center
Jira Software Data Center
AppDynamics NodeJS Agent
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component
watsonx Code Assistant On Prem
Maximo Application Suite - Visual Inspection Component
Maximo Application Suite Ai Service
Fedora
linux-sgx
IBM QRadar Data Synchronization App

Install updates from vendor's website.

node-tar - update to 7.5.3
Voice Gateway - addressed in versions 1.0.8.17, 1.0.8.18, 1.0.8.24, 1.0.8.29
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.3.1 Patch 2
IBM Watson Discovery for IBM Cloud Pak for Data - update to 5.3.1
watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component - update to 5.3.1
watsonx Code Assistant On Prem - update to 5.3.1
Jira Service Management Data Center - addressed in versions 10.3.18, 11.3.3
Maximo Application Suite - Visual Inspection Component - addressed in versions 8.9.20, 9.0.17, 9.1.10
Confluence Data Center - addressed in versions 9.2.19, 10.2.10
Maximo Application Suite Ai Service - update to 9.1.13
Jira Software Data Center - addressed in versions 10.3.18, 11.3.3
AppDynamics NodeJS Agent - update to 25.12.1
linux-sgx - update to 2.26-34.fc43
IBM QRadar Data Synchronization App - update to 4.0.0

• Exploit #12316 - Insufficient Link Path Sanitization (January 19, 2026)

• https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97

• Path traversal in node-tar
• Multiple vulnerabilities in IBM Voice Gateway
• Fedora 43 update for linux-sgx
• Multiple vulnerabilities in IBM watsonx Code Assistant On Prem
• Splunk AppDynamics NodeJS Agent update for third-party components
• Jira Service Management Data Center update for path traversal in node-tar
• IBM Maximo Application Suite - Visual Inspection Component update for node-tar
• IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component update for node-tar
• Multiple vulnerabilities in Maximo AI Service SaaS
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge
• IBM Watson Discovery Cartridge update for node-tar
• Confluence Data Center update for node-tar
• Jira Software Data Center update for node-tar
• Multiple vulnerabilities in IBM QRadar Data Synchronization App