CVE-2018-20834: Arbitrary File Overwrite in tar
Summary
CVE-2018-20834: Arbitrary File Overwrite in tar. Affects tar across 2 version ranges.
< 2.2.2
>= 3.0.0, < 4.4.2
Fixed in 2.2.2 or 4.4.2, depending on the release line you run. How to fix ↓
Also tracked for
- node-tar · Debian:11
The same CVE-2018-20834 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'tar' package is a popular open-source tool used for creating and manipulating tar archives. It provides functionality to extract and pack files and directories. The vulnerability in versions prior to 4.4.2 for 4.x and 2.2.2 for 2.x allows for arbitrary file overwrite when extracting tarballs containing a hardlink to an existing file on the system. If a file in the tarball matches the hardlink, it will overwrite the system's file with the contents of the extracted file.
Vulnerability Detail
The vulnerability arises due to a flaw in the handling of hardlinks during the extraction process. When extracting a tarball, the 'tar' package fails to properly check if a file with the same name as the hardlink already exists on the system. As a result, if a file in the tarball matches the hardlink, it will overwrite the existing file on the system. This can lead to unintended modifications or deletions of critical files, potentially causing system instability or unauthorized access.
How To Fix
Latest published version: 7.5.22 as of 22 Oct 2026
npm install tar@7.5.22Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.2.22.2.2npm install tar@2.2.2 -
>= 3.0.0, < 4.4.24.4.2npm install tar@4.4.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions mentioned above to mitigate the risk of arbitrary file overwrite.
Conclusion
The 'tar' package prior to versions 4.4.2 for 4.x and 2.2.2 for 2.x is vulnerable to arbitrary file overwrite. To mitigate this risk, it is crucial to upgrade to the fixed versions mentioned above. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for tar →
FAQ
The vulnerability allows an attacker to overwrite existing files on the system, potentially leading to unauthorized access, data loss, or system instability.
No, only versions prior to 4.4.2 for 4.x and 2.2.2 for 2.x are vulnerable to this issue.
There is no known exploit at the moment. However, it is crucial to upgrade to the fixed versions to prevent any potential exploitation.
No, upgrading to the fixed versions is the only way to mitigate the risk of arbitrary file overwrite.
You can find more information about this vulnerability in the GitHub Advisory Database: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/05/GHSA-j44m-qm6p-hp7m/GHSA-j44m-qm6p-hp7m.json
References
Related vulnerabilities
Recent vulnerabilities recorded for tar.
