Symlink Arbitrary File Overwrite in tar (GHSA-gfjr-3jmm-4g9v)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2015-8860
Severity: HIGH · CWE: CWE-59

Versions of `tar` prior to 2.0.0 are affected by an arbitrary file write vulnerability. The vulnerability occurs because `tar` does not verify that extracted symbolic links to not resolve to targets outside of the extraction root directory.



## Recommendation

Update to version 2.0.0 or later

Affected packages:
package: ecosystem: npm
name: tar
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.0.0