Hardlink Path Traversal in node-tar <7.5.7
CVE-2026-24842 Published on January 28, 2026

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal
node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.

NVD

Vulnerability Analysis

CVE-2026-24842 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-24842. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Types

What is a Directory traversal Vulnerability?

The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

CVE-2026-24842 has been classified to as a Directory traversal vulnerability or weakness.

What is an insecure temporary file Vulnerability?

The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

CVE-2026-24842 has been classified to as an insecure temporary file vulnerability or weakness.


Products Associated with CVE-2026-24842

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Enterprise Linux (RHEL)
 
Red Hat Network Observ Optr
 
Red Hat Openshift Devspaces
 
Red Hat Trusted Artifact Signer
 
Red Hat Logging
 
Red Hat 3scale Amp
 
Red Hat Rhdh
 
Red Hat Jboss Fuse
 
Red Hat Openshift
 
Red Hat Openshift Data Foundation
 
Red Hat Cryostat
 
Red Hat Multicluster Engine
 
Red Hat Acm
 
Red Hat Amq Broker
 
Red Hat Apache Camel Hawtio
 
Red Hat Hummingbird
 
Red Hat Jboss Enterprise Application Platform
 
Red Hat Jbosseapxp
 
Red Hat Openshift Ai
 
Red Hat Jboss Enterprise Bpms Platform
 
Red Hat Single Sign On
 
Red Hat Jboss Enterprise Application Platform Eus
 

Affected Versions

isaacs node-tar: Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server: Red Hat Enterprise Linux AppStream (v. 10): Red Hat Enterprise Linux AppStream (v. 9): Red Hat Network Observability (NETOBSERV) 1.11.2: Red Hat OpenShift Dev Spaces 3.27: Red Hat Trusted Artifact Signer 1.3: Logging Subsystem for Red Hat OpenShift: Red Hat 3scale API Management Platform 2: Red Hat Developer Hub: Red Hat Fuse 7: Red Hat OpenShift Container Platform 4: Red Hat Openshift Data Foundation 4: Red Hat Cryostat 4: Red Hat Multicluster Engine for Kubernetes: Red Hat Advanced Cluster Management for Kubernetes 2: Red Hat AMQ Broker 7: Red Hat build of Apache Camel - HawtIO 4: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 6: Red Hat Enterprise Linux 7: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 9: Red Hat Hardened Images: Red Hat JBoss Enterprise Application Platform 7: Red Hat JBoss Enterprise Application Platform 8: Red Hat JBoss Enterprise Application Platform Expansion Pack: Red Hat OpenShift AI (RHOAI): Red Hat OpenShift Dev Spaces: Red Hat Process Automation 7: Red Hat Single Sign-On 7:

Exploit Probability

EPSS
0.52%
Percentile
39.95%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.