High · published January 28, 2026
⚡ A sneaky mismatch in path handling could let attackers create hardlinks to any file they choose! Think of it like a delivery driver who misreads an address and drops a package in a completely wrong location instead of the intended recipient — this flaw allows attackers to redirect files outside their intended boundaries! An attacker could exploit this vulnerability to create hardlinks to sensitive files on the server, potentially exposing confidential information or compromising other system functionalities. Imagine the chaos if someone redirected all your important documents to a stranger’s mailbox!
Think of it like a delivery driver who misreads an address and drops a package in a completely wrong location instead of the intended recipient — this flaw allows attackers to redirect files outside their intended boundaries! In node-tar versions prior to 7.5.7, the check for hardlink entries uses a different resolution method than the actual creation logic, leading to path traversal protection being bypassed. This allows crafted TAR files to create hardlinks to arbitrary files outside the extraction directory.
An attacker could exploit this vulnerability to create hardlinks to sensitive files on the server, potentially exposing confidential information or compromising other system functionalities. Imagine the chaos if someone redirected all your important documents to a stranger’s mailbox! Upgrade node-tar to version 7.5.7 or later immediately to close off this vulnerability. After upgrading, review your TAR file handling procedures to ensure that hardlink creation is properly validated. Regular audits of archived files wouldn't hurt either! You've got this! With these steps, you're on your way to securing your systems! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| isaacs/tar | < 7.5.7 | 7.5.7 |