---
title: "GHSA-gfjr-3jmm-4g9v: Symlink Arbitrary File Overwrite in tar"
description: "High severity. Symlink Arbitrary File Overwrite in tar. Affects tar; fixed in 2.0.0."
url: https://inlinr.com/advisories/GHSA-gfjr-3jmm-4g9v
lang: en
---

[Packages](https://inlinr.com/packages) / [tar](https://inlinr.com/packages/tar) / [Security](https://inlinr.com/packages/tar/security)

High Vulnerability GHSA-gfjr-3jmm-4g9v CVE-2015-8860 Published 24 Oct 2017

# Symlink Arbitrary File Overwrite in tar

Your version 

Affected releases · [tar](https://inlinr.com/packages/tar)

- 1.x and older 0.0.1 – 1.0.3 No fix, no longer updated

1.x has no fix yet; the newest fixed line:

```
npm install tar@2.0.0
```

Every release on a timeline

7.x 

1. Not affected

7.0.0 – 7.5.22  
33 releases, latest

1.x 

1. Affected

1.0.0 – 1.0.3  
4 releases

0.x 

1. Affected

0.0.1 – 0.1.20  
21 releases

154 stable releases of tar, oldest to newest, one row per major.

## What happens

Versions of `tar` prior to 2.0.0 are affected by an arbitrary file write vulnerability. The vulnerability occurs because `tar` does not verify that extracted symbolic links to not resolve to targets outside of the extraction root directory.

Recommendation

Update to version 2.0.0 or later

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: high
- **Availability**: none

CVSS:3.0/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:H/​A:N

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2015-8860 "https://nvd.nist.gov/vuln/detail/CVE-2015-8860")  
nvd.nist.gov/vuln/detail/CVE-2015-8860
- [GitHub advisory](https://github.com/advisories/GHSA-gfjr-3jmm-4g9v "https://github.com/advisories/GHSA-gfjr-3jmm-4g9v")  
github.com/advisories/GHSA-gfjr-3jmm-4g9v
- [Package](https://github.com/npm/npm "https://github.com/npm/npm")  
github.com/npm/npm
- [Reference](https://github.com/npm/npm/releases/tag/v2.7.5 "https://github.com/npm/npm/releases/tag/v2.7.5")  
github.com/npm/npm/releases/tag/v2.7.5
- [Reference](https://www.npmjs.com/advisories/57 "https://www.npmjs.com/advisories/57")  
npmjs.com/advisories/57
- [Reference](http://www.openwall.com/lists/oss-security/2016/04/20/11 "http://www.openwall.com/lists/oss-security/2016/04/20/11")  
openwall.com/lists/oss-security/2016/04/20/11