Gnu Tar vulnerabilities

CVE-2007-4476 [HIGH] CWE-119 CVE-2007-4476: Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impa Buffer overflow in the safer_name_suffix function in GNU tar has unspecified attack vectors and impact, resulting in a "crashing stack."

CVE-2021-32804 [HIGH] CWE-22 Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization ### Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution `node-tar` aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from an

CVE-2016-6321 [HIGH] CWE-22 CVE-2016-6321: Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 mig Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection mechanism and write to arbitrary files via vectors related to improper sanitization of the file_name parameter, aka POINTYFEATHER.

CVE-2021-32803 [HIGH] CWE-22 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning ### Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted director

CVE-2006-6097 [MEDIUM] CVE-2006-6097: GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite ar GNU tar 1.16 and 1.15.1, and possibly other versions, allows user-assisted attackers to overwrite arbitrary files via a tar file that contains a GNUTYPE_NAMES record with a symbolic link, which is not properly handled by the extract_archive function in extract.c and extract_mangle function in mangle.c, a variant of CVE-2002-1216.

CVE-2021-37701 [HIGH] CWE-22 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links ### Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution `node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, ac

CVE-2026-24842 [HIGH] CWE-22 node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal ### Summary node-tar contains a vulnerability where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlin

CVE-2015-8860 [HIGH] CWE-59 Symlink Arbitrary File Overwrite in tar Symlink Arbitrary File Overwrite in tar Versions of `tar` prior to 2.0.0 are affected by an arbitrary file write vulnerability. The vulnerability occurs because `tar` does not verify that extracted symbolic links to not resolve to targets outside of the extraction root directory. ## Recommendation Update to version 2.0.0 or later

CVE-2021-37712 [HIGH] CWE-22 Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links ### Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achie

CVE-2026-33055 [HIGH] CWE-843 tar-rs incorrectly ignores PAX size headers if header size is nonzero tar-rs incorrectly ignores PAX size headers if header size is nonzero ### Summary As part of [CVE-2025-62518](https://www.cve.org/CVERecord?id=CVE-2025-62518) the astral-tokio-tar project was changed to correctly honor PAX size headers in the case where it was different from the base header. However, it was missed at the time that this project (the original Rust `tar` crate) had a conditional l

CVE-2021-37713 [HIGH] CWE-22 Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization ### Impact Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within

CVE-2005-2541 [CRITICAL] CVE-2005-2541: Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow l Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.

CVE-2018-20834 [HIGH] CWE-59 Arbitrary File Overwrite in tar Arbitrary File Overwrite in tar Versions of `tar` prior to 4.4.2 for 4.x and 2.2.2 for 2.x are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file. ## Recommendation For tar 4.x, upgrade to version 4.4.2 or later. For tar 2.x, upgrade to version 2.2.

CVE-2026-59873 [CRITICAL] CWE-770 node-tar: Decompression/parse DoS via unlimited input node-tar: Decompression/parse DoS via unlimited input ### Summary A **Decompression/parse DoS via unlimited input** vulnerability in `node-tar` allows an attacker to exhaust server resources (disk space and CPU). Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted "Gzip Bomb" can be used to fill a server's storage and crash services.

CVE-2010-0624 [MEDIUM] CWE-119 CVE-2010-0624: Heap-based buffer overflow in the rmt_read__ function in lib/rtapelib.c in the rmt client functional Heap-based buffer overflow in the rmt_read__ function in lib/rtapelib.c in the rmt client functionality in GNU tar before 1.23 and GNU cpio before 2.11 allows remote rmt servers to cause a denial of service (memory corruption) or possibly execute arbitrary code by sending more data than was requested, related to archive filenames that contain a : (col

CVE-2018-20990 [HIGH] CWE-59 Arbitrary file overwrite in tar-rs Arbitrary file overwrite in tar-rs When unpacking a tarball with the unpack_in-family of functions it's intended that only files within the specified directory are able to be written. Tarballs with hard links or symlinks, however, can be used to overwrite any file on the filesystem. Tarballs can contain multiple entries for the same file. A tarball which first contains an entry for a hard link or symlink pointing to any file on the

CVE-2021-38511 [HIGH] CWE-22 Links in archive can create arbitrary directories Links in archive can create arbitrary directories When unpacking a tarball that contains a symlink the tar crate may create directories outside of the directory it's supposed to unpack into. The function errors when it's trying to create a file, but the folders are already created at this point.

CVE-2019-9923 [HIGH] CWE-476 CVE-2019-9923: pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing cer pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.

CVE-2026-59874 [HIGH] CWE-835 node-tar: Negative tar entry size causes infinite loop in archive replace node-tar: Negative tar entry size causes infinite loop in archive replace ### Summary A checksum-valid tar archive with a negative base-256 encoded entry size can make `tar.replace()` loop forever while scanning the existing archive. Applications that update attacker-controlled tar archives can have a worker process pinned indefinitely, causing denial of service. ### Details The public `ta

CVE-2026-59871 [MEDIUM] CWE-704 node-tar: Process crash via PAX numeric path type confusion node-tar: Process crash via PAX numeric path type confusion ### Summary A crafted 2.5KB tar archive crashes any Node.js process that extracts it. The PAX header parser coerces all-digit path values to JavaScript numbers, which causes an uncaught TypeError when downstream code calls `.split('/')` on the numeric value. Error handlers and `strict: false` cannot intercept the crash. ### Details In `pax.ts