Node.js `tar` Package Symlink Path Traversal — CVE-2026-29786

Metadata

Affected Target

Summary

The tar package’s extraction engine does not sufficiently validate destination paths when an archive entry is of type symlink. An attacker can craft a tarball containing a symlink entry that points outside the intended extraction directory (e.g. to /etc/shadow or an application config file). When a victim extracts the malicious archive, the extraction engine follows the symlink and subsequent writes are redirected to the attacker-chosen target path, resulting in arbitrary file overwrite outside the extraction root — a classic tar symlink path-traversal issue.

Vulnerability Details

Root Cause

tar’s extraction logic does not properly validate/normalize the resolved destination of symlink entries against the extraction root, allowing symlink targets to escape the intended output directory.

Attack Vector

1. Attacker crafts a malicious tarball containing a symlink-type entry that targets a path outside the extraction directory.
2. Attacker delivers the tarball to a victim (e.g. via a package, download, or upload feature that later extracts archives).
3. Victim extracts the archive using a vulnerable tar version.
4. The extraction engine follows the symlink and any subsequent write attributed to that entry is redirected to the attacker’s target path, overwriting sensitive files.

Impact

Arbitrary file write/overwrite outside the intended extraction directory, potentially leading to configuration tampering, privilege escalation, or code execution depending on which file is overwritten.

Environment / Lab Setup

Target:   Node.js application using tar@7.5.9 to extract untrusted archives
Attacker: Node.js runtime, `poc.cjs` script

Proof of Concept

PoC Script

See poc.cjs in this folder.

1
2

npm install tar@7.5.9
node poc.cjs

poc.cjs builds a malicious tarball containing a symlink entry that escapes the extraction directory, then extracts it using the vulnerable tar package to demonstrate the out-of-bounds file write.

Detection & Indicators of Compromise

Signs of compromise:

• Unexpected modification timestamps on files outside an application’s designated extraction directory
• Archive-extraction logs showing symlink entries with ..-style or absolute targets
• File-integrity monitoring alerts correlated with archive upload/extraction endpoints

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/Rohitberiwala/NodeJS-Tar-Symlink-Exploit-CVE-2026-29786 on 2026-07-05.