CVE-2024-12905
CVSS 3.1 Score 7.5 of 10 (high)
Details
Published Mar 27, 2025
Updated: Apr 20, 2025
CWE ID 59
CWE ID 22
Summary
CVE-2024-12905 is a vulnerability affecting the tar-fs package, specifically in the index.js file. This issue involves improper link resolution and path traversal during the extraction of a maliciously crafted tar file. Consequently, unauthorized file writes or overwrites outside the intended extraction directory can occur. This vulnerability exists in tar-fs versions prior to 1.16.4, 2.1.2, and 3.0.8.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.