{"uuid": "22f10a61-ce1a-4807-8aee-d1121f01d495", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-12905", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/12614", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-12905\n\ud83d\udd25 CVSS Score: 7.5 (cvssV3_1, Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)\n\ud83d\udd39 Description: An Improper Link Resolution Before File Access (\"Link Following\") and Improper Limitation of a Pathname to a Restricted Directory (\"Path Traversal\"). This vulnerability occurs when extracting a maliciously crafted tar file, which can result in unauthorized file writes or overwrites outside the intended extraction directory. The issue is associated with index.js in the tar-fs package.\n\nThis issue affects tar-fs: from 0.0.0 before 1.16.4, from 2.0.0 before 2.1.2, from 3.0.0 before 3.0.8.\n\ud83d\udccf Published: 2025-03-27T16:25:34.410Z\n\ud83d\udccf Modified: 2025-04-20T15:42:44.814Z\n\ud83d\udd17 References:\n1. https://github.com/mafintosh/tar-fs/commit/a1dd7e7c7f4b4a8bd2ab60f513baca573b44e2ed\n2. https://www.seal.security/blog/a-link-to-the-past-uncovering-a-new-vulnerability-in-tar-fs", "creation_timestamp": "2025-04-20T16:01:34.000000Z"}