CVE-2025-59343

highpriority · track · 0EPSS 0.006 · 45 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.55% (45th) EPSS

CVSS 7.5 · high

Is it mine?

17 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-22

tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.

cvss

Technical severity, 0–10. One row per scoring source.

8.7

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.6–8.7

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:Nsecondary · FSTEC (BDU) RU

v4.08.7highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:Nsecondary · ENISA EU

v4.08.7highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · security-advisories@github.com

v4.06.6mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-22USCWE-22USCWE-22USCWE-61USCWE-61USCWE-61US

affected products (17)

Products and version ranges known to be affected.

Red Hat Ansible Automation Platformall versionscert_bundDEcpe:/a:redhat:ansible_automation_platform:-
Red Hat Ansible Automation Platform 2.6 for RHEL 9 aarch64all versionscert_bundDEcpe:/a:redhat:ansible_automation_platform:2.6_for_rhel_9_aarch64
Red Hat Ansible Automation Platform 2.6 for RHEL 9 ppc64leall versionscert_bundDEcpe:/a:redhat:ansible_automation_platform:2.6_for_rhel_9_ppc64le
Red Hat Ansible Automation Platform 2.6 for RHEL 9 s390xall versionscert_bundDEcpe:/a:redhat:ansible_automation_platform:2.6_for_rhel_9_s390x
Red Hat Ansible Automation Platform 2.6 for RHEL 9 x86_64all versionscert_bundDEcpe:/a:redhat:ansible_automation_platform:2.6_for_rhel_9_x86_64
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
mafintosh tar-fs≤ < 1.16.5enisa_euvdEU
mafintosh tar-fs2.0.0, → 2.1.3enisa_euvdEU
mafintosh tar-fs3.0.0, → 3.1.1enisa_euvdEU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 3.1fstec_bduRU
Сообщество свободного программного обеспечения tar-fs≤ 1.16.5fstec_bduRU
Сообщество свободного программного обеспечения tar-fs≤ 2.1.3fstec_bduRU
Сообщество свободного программного обеспечения tar-fs≤ 3.1.1fstec_bduRU
npm tar-fs< 1.16.6osvUSpkg:npm/tar-fs
npm tar-fs2.0.0 → 2.1.4osvUSpkg:npm/tar-fs
npm tar-fs3.0.0 → 3.1.1osvUSpkg:npm/tar-fs

advisories (5)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-2313IBM App Connect Enterprise: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2025-10-15csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
WID-SEC-W-2025-2432Red Hat Ansible Automation Platform: Mehrere SchwachstellenDeutsch2025-10-28csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Ansible Automation Platform ausnutzen, um Dateien zu manipulieren, offenzulegen oder Privilegien zu eskalieren.
WID-SEC-W-2025-2762HCL BigFix: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2025-12-08csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in HCL BigFix ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
WID-SEC-W-2026-0438Atlassian Bamboo und Confluence (Data Center und Server): Mehrere SchwachstellenDeutsch2026-02-17csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Atlassian Bamboo und Atlassian Confluence ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen und Cross-Site-Scripting-Angriffe durchzuführen.
GHSA-vj76-c3g6-qr5vtar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball2025-09-24ghsa · osvUS
### Impact v3.1.0, v2.1.3, v1.16.5 and below ### Patches Has been patched in 3.1.1, 2.1.4, and 1.16.6 ### Workarounds You can use the ignore option to ignore non files/directories. ```js ignore (_, header) { // pass files & directories, ignore e.g. symlinks return header.type !== 'file' && header.type !== 'directory' } ``` ### Credit Reported by: Mapta / BugBunny_ai

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund osv NVD CVE.org MITRE

published 2025-09-24modified 2026-06-17

references (8)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan