CVE-2025-45582

Name of the Vulnerable Software and Affected Versions: GNU Tar versions through 1.35

Description: GNU Tar through version 1.35 is susceptible to a directory traversal vulnerability that allows for file overwrites within crafted TAR archives. The vulnerability requires a two-step process: first, extracting an archive containing a ../ symlink to a critical directory, and second, extracting an archive containing a critical file specified via a relative pathname beginning with the symlink name. This process bypasses the standard protection mechanism that prevents file access through paths containing ... An example of this attack involves an archive containing "x -> ../../../../../home/victim/.ssh" followed by an archive containing "x/authorized keys", potentially overwriting the authorized keys file. This issue can impact server applications that automatically extract user-supplied TAR archives and software installation processes involving multiple tar xf commands.

Recommendations: Versions prior to 1.36 are affected.