CVE-2024-12905: Path Traversal
First published: Thu Mar 27 2025(Updated: )
An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package. This issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.7.
Credit: 22e2d327-25fe-45d7-9f0c-dcd23b7108df
| Affected Software | Affected Version | How to fix |
|---|---|---|
| tar-fs | >=0.0.0<1.16.4>=2.0.0<2.1.2>=3.0.0<3.0.8 | |
| npm/tar-fs | >=3.0.0<3.0.7 | 3.0.8 |
| npm/tar-fs | >=2.0.0<2.1.2 | 2.1.2 |
| npm/tar-fs | <1.16.4 | 1.16.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-12905?
CVE-2024-12905 has been classified with a severity rating that indicates it poses a significant risk of unauthorized file access or system compromise.
How do I fix CVE-2024-12905?
To fix CVE-2024-12905, upgrade to a version of tar-fs that is not vulnerable, ensuring you are using at least version 1.16.4 or 2.1.3 and above.
What systems are affected by CVE-2024-12905?
CVE-2024-12905 affects tar-fs versions from 0.0.0 up to but not including 1.16.4, and versions from 2.0.0 up to but not including 2.1.3, and 3.0.0 up to but not including 3.0.9.
What can happen if CVE-2024-12905 is exploited?
Exploitation of CVE-2024-12905 can lead to unauthorized file writes or overwrites, potentially affecting the security of the filesystem.
Is CVE-2024-12905 related to path traversal vulnerabilities?
Yes, CVE-2024-12905 is related to both improper link resolution before file access and improper limitation of a pathname to a restricted directory, which may allow path traversal.
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/severity
- agent/weakness
- agent/author
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- collector/nvd-api
- source/NVD
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-pq67-2wwv-3xjx
- alias/CVE-2024-12905
- agent/last-modified-date
- agent/source
- agent/references
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/nvd-cve
- vendor/tar-fs
- canonical/tar-fs
- package-manager/npm