CVE-2025-48387: tar-fs Package Vulnerability Allowing Extraction Outside Specified Directory
Summary
CVE-2025-48387: tar-fs can extract outside the specified dir with a specific tarball. Affects tar-fs across 3 version ranges.
< 1.16.5
>= 2.0.0, < 2.1.3
>= 3.0.0, < 3.0.9
Fixed in 1.16.5, 2.1.3 or 3.0.9, depending on the release line you run. How to fix ↓
Also tracked for
- node-tar-fs · Debian:11
The same CVE-2025-48387 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The tar-fs package is a Node.js library that provides a way to create and extract tar archives. It is commonly used in applications that require file compression and decompression. However, certain versions of tar-fs are vulnerable to a security issue that allows attackers to extract files outside the intended directory, potentially leading to unauthorized access to sensitive files.
Vulnerability Detail
The vulnerability in tar-fs arises from improper handling of tarball extraction paths, specifically in versions v3.0.8, v2.1.2, and v1.16.4 and below. This flaw allows attackers to craft a malicious tarball that, when extracted, can place files in unintended locations on the filesystem. The potential ramifications include unauthorized file access and system compromise, making it critical for users of affected versions to address this issue promptly.
How To Fix
Latest published version: 3.1.3 as of 23 Oct 2026
npm install tar-fs@3.1.3Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.16.51.16.5npm install tar-fs@1.16.5 -
>= 2.0.0, < 2.1.32.1.3npm install tar-fs@2.1.3 -
>= 3.0.0, < 3.0.93.0.9npm install tar-fs@3.0.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement an ignore option in your extraction code to prevent the extraction of symlinks and other non-file types. Here is an example of how to do this:
ignore (_, header) {
// pass files & directories, ignore e.g. symlinks
return header.type !== 'file' && header.type !== 'directory';
}
Conclusion
The tar-fs package has a significant vulnerability that allows for extraction outside of the specified directory, which can lead to serious security risks. Users are strongly advised to update to the latest patched versions or implement the provided workaround to mitigate the issue. Regular monitoring of dependencies using tools like Vulert can help maintain security in your applications.
See every vulnerability recorded for tar-fs →
FAQ
Versions v3.0.8, v2.1.2, and v1.16.4 and below are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive files and potential system compromise due to files being extracted to unintended locations.
You can update the tar-fs package by running the command 'npm install tar-fs@<version>' in your project directory, replacing <version> with 3.0.9, 2.1.3, or 1.16.5, depending on your current version.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in your software using just package-lock.json. It helps you stay informed about potential security issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for tar-fs.
