CVE-2024-12905

Published Mar 27, 2025

Last updated 5 months ago

CVSS high 7.5
Supply chain

Overview

Description
An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package. This issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.
Source
22e2d327-25fe-45d7-9f0c-dcd23b7108df
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
7.5
Impact score
3.6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity
HIGH

Weaknesses

22e2d327-25fe-45d7-9f0c-dcd23b7108df
CWE-22

Social media

Hype score
Not currently trending

  1. BREAKING: Ubuntu and Mageia patch tar flaws CVE-2024-12905, CVE-2025-48387, CVE-2025-59343, CVE-2026-5704 letting remote attackers overwrite files and inject hidden content via malicious archives. https://t.co/decEFt5fqN

    @threatcluster

    2 Jun 2026

    54 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. 📢 Critical patch alert! 🚨 #Debian 11 fixes symlink/hardlink path traversal in node-tar-fs (CVE-2024-12905, CVE-2025-48387). Read more: 👉 https://t.co/uSR5pGi4AZ #CyberSecurity #Debian #NodeJS https://t.co/1PTVC70Vvu

    @Cezar_H_Linux

    12 Jun 2025

    51 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. We recently discovered a previously overlooked vulnerability in tar-fs Uncovered (CVE-2024-12905) that allows attackers to write arbitrary files—potentially leading to remote code execution. Read how Seal disclosed and patched the vulnerability. https://t.co/QUKxyeNSPN https://t.

    @SealSecurity_io

    8 Apr 2025

    58 Impressions

    0 Retweets

    1 Like

    1 Bookmark

    0 Replies

    1 Quote

  4. CVE-2024-12905 An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vulnerabili… https://t.co/flXQiht1F8

    @CVEnew

    29 Mar 2025

    736 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. TrueConf Server Code Injection Vulnerability•CVE-2026-72530
  2. TrueConf Server Missing Authentication for Critical Function Vulnerability•CVE-2026-72529
  3. In the Linux kernel, the following vulnerability has been resolved: smp: Make CSD lock acquisition atomic for debug mode Commit b0473dcd4b1d ("smp: Improve smp_call_function_single() CSD-lock diagnostics") changed smp_call_function_single() so that, when CSD lock debugging is enabled, async !wait calls use the destination CPU csd_data. That improves diagnostics, but it also removes the single-writer property that made the old csd_lock() safe: multiple CPUs can now prepare the same destination CPU CSD concurrently. csd_lock() currently waits for CSD_FLAG_LOCK to clear and then sets the bit with a non-atomic read-modify-write. Two senders can both see an unlocked CSD, set the bit, overwrite the callback fields, and enqueue the same llist node. Re-adding a node that is already the queue head can make node->next point to itself, leaving the target CPU stuck walking call_single_queue. Later synchronous work, such as a TLB shootdown, can then remain queued and trigger soft-lockup warnings or panics. Keep the single csd_lock() implementation, but when CSD lock debugging is enabled, acquire CSD_FLAG_LOCK with try_cmpxchg_acquire(). This makes the destination CPU CSD a real atomic lock in the only configuration where it can be shared by multiple remote senders, while preserving the existing non-debug fast path.•CVE-2026-68438
  4. Apple macOS Improper Authentication Vulnerability•CVE-2026-65400
  5. Broadcom VMware vCenter Path Traversal Vulnerability•CVE-2026-59310

References

Sources include official advisories and independent security research.