Hardlink Path Traversal in node-tar <7.5.7
CVE-2026-24842 Published on January 28, 2026

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-24842 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-24842. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Types

What is a Directory traversal Vulnerability?

The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVE-2026-24842 has been classified to as a Directory traversal vulnerability or weakness.

What is an insecure temporary file Vulnerability?

The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

CVE-2026-24842 has been classified to as an insecure temporary file vulnerability or weakness.


Products Associated with CVE-2026-24842

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-24842 are published in these products:

Red Hat Enterprise Linux (RHEL)
 
Red Hat Network Observ Optr
 
Red Hat Openshift Devspaces
 
Red Hat Trusted Artifact Signer
 
Red Hat Logging
 
Red Hat 3scale Amp
 
Red Hat Rhdh
 
Red Hat Jboss Fuse
 
Red Hat Openshift
 
Red Hat Openshift Data Foundation
 
Red Hat Cryostat
 
Red Hat Multicluster Engine
 
Red Hat Acm
 
Red Hat Amq Broker
 
Red Hat Apache Camel Hawtio
 
Red Hat Hummingbird
 
Red Hat Jboss Enterprise Application Platform
 
Red Hat Jbosseapxp
 
Red Hat Openshift Ai
 
Red Hat Jboss Enterprise Bpms Platform
 
Red Hat Single Sign On
 
Red Hat Jboss Enterprise Application Platform Eus
 
Oracle
 

Affected Versions

isaacs node-tar: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 9: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7: Red Hat Network Observability (NETOBSERV) 1.11.1: Red Hat Network Observability (NETOBSERV) 1.11.1: Red Hat OpenShift Dev Spaces 3.27: Red Hat OpenShift Dev Spaces 3.27: Red Hat Trusted Artifact Signer 1.3: Red Hat Cryostat 4: Logging Subsystem for Red Hat OpenShift: Logging Subsystem for Red Hat OpenShift: Logging Subsystem for Red Hat OpenShift: Logging Subsystem for Red Hat OpenShift: Logging Subsystem for Red Hat OpenShift: Logging Subsystem for Red Hat OpenShift: Red Hat Multicluster Engine for Kubernetes: Red Hat Multicluster Engine for Kubernetes: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat 3scale API Management Platform 2: Red Hat Advanced Cluster Management for Kubernetes 2: Red Hat Advanced Cluster Management for Kubernetes 2: Red Hat Advanced Cluster Management for Kubernetes 2: Red Hat AMQ Broker 7: Red Hat build of Apache Camel - HawtIO 4: Red Hat Developer Hub: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 6: Red Hat Enterprise Linux 7: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Red Hat Fuse 7: Red Hat Fuse 7: Red Hat Fuse 7: Red Hat Fuse 7: Red Hat Hardened Images: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 8: Red Hat JBoss Enterprise Application Platform 8: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift AI (RHOAI): Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4: Red Hat Openshift Data Foundation 4: Red Hat Openshift Data Foundation 4: Red Hat Openshift Data Foundation 4: Red Hat Openshift Data Foundation 4: Red Hat OpenShift Dev Spaces: Red Hat OpenShift Dev Spaces: Red Hat Process Automation 7: Red Hat Process Automation 7: Red Hat Single Sign-On 7:

Exploit Probability

EPSS
0.54%
Percentile
42.24%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.