8.2Hoch

CVE-2026-29786node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

isaacs node-tar; Red Hat Cryostat 4; Red Hat Logging Subsystem for Red Hat OpenShift; Red Hat Network Observability Operator Veröffentlicht: 2026-03-07 18:32 (vor 8 Monaten)

Beschreibung

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This issue has been patched in version 7.5.10.

Schwachstellentyp (CWE): CWE-22 CWE-59

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Hersteller	Produkt	Versionen
isaacs	node-tar	< 7.5.10
isaacs	tar	< 7.5.10
Red Hat	Cryostat 4	—
Red Hat	Logging Subsystem for Red Hat OpenShift	—
Red Hat	Network Observability Operator	—
Red Hat	Red Hat 3scale API Management Platform 2	—
Red Hat	Red Hat Advanced Cluster Management for Kubernetes 2	—
Red Hat	Red Hat AMQ Broker 7	—
Red Hat	Red Hat build of Apache Camel - HawtIO 4	—
Red Hat	Red Hat Enterprise Linux 10	—
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Fuse 7	—
Red Hat	Red Hat JBoss Enterprise Application Platform 7	—
Red Hat	Red Hat JBoss Enterprise Application Platform 8	—
Red Hat	Red Hat JBoss Enterprise Application Platform Expansion Pack	—
Red Hat	Red Hat OpenShift AI (RHOAI)	—
Red Hat	Red Hat OpenShift Container Platform 4	—
Red Hat	Red Hat Openshift Data Foundation 4	—
Red Hat	Red Hat OpenShift Dev Spaces	—
Red Hat	Red Hat Process Automation 7	—
Red Hat	Red Hat Single Sign-On 7	—
Red Hat	Red Hat Trusted Artifact Signer	—

Referenzen und Patches

CPE-Treffer (NVD) (1)

cpe:2.3:a:isaacs:tar:*:*:*:*:*:node.js:*:* < 7.5.10

CVSS-Score

8.2Hoch

Quelle: GitHub_M · CVSS 4.0

Angriffsvektor: Lokal
Komplexität: Niedrig
Voraussetzungen: Keine
Rechte erforderlich: Keine
Benutzerinteraktion: Passiv
Vertraulichkeit: Keine
Integrität: Hoch
Verfügbarkeit: Niedrig

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L

Alle Scores (5)

cna	CVSS 4.0	8.2Hoch
redhat-SADP	CVSS 3.1	8.6Hoch
security-advisories@github.com	CVSS 4.0	8.2Hoch
nvd	CVSS 3.1	6.3Mittel
0b0ca135-0b70-47e7-9f44-1890c2a1c46c	CVSS 3.1	8.6Hoch

EPSS (Ausnutzungswahrscheinlichkeit in 30 Tagen)

0.51%

höher als 44 % aller CVEs

CISA-Bewertung (SSVC)

Ausnutzung: poc
Automatisierbar: no
Technische Auswirkung: partial

Zeitverlauf

ID reserviert2026-03-04
Veröffentlicht2026-03-07 18:32
Bei IP-DB eingegangen2026-10-24 23:42
Zuletzt aktualisiert2026-09-01 16:18

Vergeben von (CNA): GitHub_M
NVD-Status: Modified

In der Quelle ansehen: CVE.org · NVD

Benachrichtigung bei neuen Schwachstellen in diesen Produkten

E-Mail-Warnungen aktivieren

Kostenlos · mit Konto · jederzeit abbestellbar

Neue CVEs im selben Produkt — Red Hat Enterprise Linux

6.2Mittel

CVE-2026-128886 gestern

Dbus: server accept watch can be stalled by blocking nonce-tcp accept_with_noncefile path

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an exposed listener can cause a Denial of Service (DoS) by opening a connection and withholding the expected authentication token. Because th…

5.5Mittel

CVE-2026-110330 gestern

Abrt: abrt: abrt-server trusts client-supplied pid= allowing unprivileged read of other processes' /proc environ

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This al…

7.8Hoch

CVE-2026-110331 gestern

Abrt: abrt: incomplete cve-2026-54228/54229 fix — completeness gate bypassed via attacker-supplied count element

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard a…

6.2Mittel

CVE-2026-128987 gestern

Dbus: infinite cpu-spin loop in libdbus socket transport when epipe is received during write operations

Red Hat Red Hat Enterprise Linux 10

A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors a…

5.5Mittel

CVE-2026-128885 gestern

Dbus: stack out-of-bounds write in dbus _dbus_poll() select() fallback when file descriptor exceeds fd_setsize

Red Hat Red Hat Enterprise Linux 10

A flaw was found in D-Bus. In configurations where the daemon falls back to using the Unix select() mechanism for event monitoring, it does not verify whether file descriptor numbers exceed allocated limits. A local attacker can exploit this flaw by opening a…

8.8Hoch

CVE-2026-18379 vor 3 Tagen

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo

Red Hat Red Hat Enterprise Linux 10

A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize…