CVE-2026-26960

Katalog CVE

CVSS 7.1 · High EPSS 0,21%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada isaacs tar. Skor CVSS 3.1 7.1 (High) menurut NVD.

Deskripsi (NVD)

node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.

Rincian

Terbit di NVD

20 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.1 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 9,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx exploit · advisory vendor
• https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384 patch
• https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f patch