---
title: "GHSA-3jfq-g458-7qm9: Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization"
description: "High severity. Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization. Affects tar; fixed in 6.1.1."
url: https://inlinr.com/advisories/GHSA-3jfq-g458-7qm9
lang: en
---

[Packages](https://inlinr.com/packages) / [tar](https://inlinr.com/packages/tar) / [Security](https://inlinr.com/packages/tar/security)

High Vulnerability GHSA-3jfq-g458-7qm9 CVE-2021-32804 Published 3 Aug 2021

# Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization

Your version 

Affected releases · [tar](https://inlinr.com/packages/tar)

- 6.x 6.0.0 – 6.1.0 Fixed in 6.1.1
- 5.x 5.0.0 – 5.0.5 Fixed in 5.0.6
- 4.x 4.0.0 – 4.4.13 Fixed in 4.4.14
- 3.x 3.0.0 – 3.2.1 Fixed in 3.2.2
- 2.x and older 0.0.1 – 2.2.2 No fix, no longer updated

On 6.x, the newest line:

```
npm install tar@6.1.1
```

Every release on a timeline

7.x 

1. Not affected

7.0.0 – 7.5.22  
33 releases, latest

6.x 

1. Affected

6.0.0 – 6.1.0  
7 releases
2. Fixed

6.1.1 – 6.2.1  
17 releases

5.x 

1. Affected

5.0.0 – 5.0.5  
6 releases
2. Fixed

5.0.6 – 5.0.11  
6 releases

4.x 

1. Affected

4.0.0 – 4.4.13  
25 releases
2. Fixed

4.4.14 – 4.4.19  
6 releases

3.x 

1. Affected

3.0.0 – 3.2.1  
20 releases
2. Fixed

3.2.2 – 3.2.3  
2 releases

2.x 

1. Affected

2.0.0 – 2.2.2  
7 releases

1.x 

1. Affected

1.0.0 – 1.0.3  
4 releases

0.x 

1. Affected

0.0.1 – 0.1.20  
21 releases

154 stable releases of tar, oldest to newest, one row per major.

## What happens

Impact

Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

`node-tar` aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. 

This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. 

Patches

3.2.2 || 4.4.14 || 5.0.6 || 6.1.1

NOTE: an adjacent issue [CVE-2021-32803](https://github.com/npm/node-tar/security/advisories/GHSA-r628-mhmh-qjhw "https://github.com/npm/node-tar/security/advisories/GHSA-r628-mhmh-qjhw") affects this release level. Please ensure you update to the latest patch levels that address CVE-2021-32803 as well if this adjacent issue affects your `node-tar` use case.

Workarounds

Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths.

```
const path = require('path')
const tar = require('tar')

tar.x({
  file: 'archive.tgz',
  // either add this function...
  onentry: (entry) => {
    if (path.isAbsolute(entry.path)) {
      entry.path = sanitizeAbsolutePathSomehow(entry.path)
      entry.absolute = path.resolve(entry.path)
    }
  },

  // or this one
  filter: (file, entry) => {
    if (path.isAbsolute(entry.path)) {
      return false
    } else {
      return true
    }
  }
})
```

Users are encouraged to upgrade to the latest patch versions, rather than attempt to sanitize tar input themselves.

## How it is exploited

Exploitable with local access, with no account and a user to do something.

- **Confidentiality**: high
- **Integrity**: high
- **Availability**: none

CVSS:3.1/​AV:L/​AC:L/​PR:N/​UI:R/​S:C/​C:H/​I:H/​A:N

## References

- [Reference](https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9 "https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9")  
github.com/npm/node-tar/security/advisories/GHS…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-32804 "https://nvd.nist.gov/vuln/detail/CVE-2021-32804")  
nvd.nist.gov/vuln/detail/CVE-2021-32804
- [Fix commit](https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4 "https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4")  
1f036ca
- [Reference](https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf")  
cert-portal.siemens.com/productcert/pdf/ssa-389…
- [Package](https://github.com/npm/node-tar "https://github.com/npm/node-tar")  
github.com/npm/node-tar
- [Reference](https://www.npmjs.com/advisories/1770 "https://www.npmjs.com/advisories/1770")  
npmjs.com/advisories/1770
- [Reference](https://www.npmjs.com/package/tar "https://www.npmjs.com/package/tar")  
npmjs.com/package/tar
- [Reference](https://www.oracle.com/security-alerts/cpuoct2021.html "https://www.oracle.com/security-alerts/cpuoct2021.html")  
oracle.com/security-alerts/cpuoct2021.html