CVE-2025-59343: tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

September 24, 2025 (updated November 10, 2025)

v3.1.0, v2.1.3, v1.16.5 and below

References

github.com/advisories/GHSA-vj76-c3g6-qr5v
github.com/mafintosh/tar-fs
github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09
github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v
nvd.nist.gov/vuln/detail/CVE-2025-59343

Code Behaviors & Features

Detect and mitigate CVE-2025-59343 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →