tar-fs Symlink Validation Bypass Vulnerability

A symlink validation bypass vulnerability has been identified in tar-fs versions prior to 3.1.1, 2.1.3, and 1.16.5. This vulnerability arises when the destination directory is predictable with a specific tarball, allowing for potential exploitation.

Impact

Exploitation of this vulnerability could lead to unauthorized manipulation of symlinks, potentially causing files to be overwritten or read inappropriately.

Remediation

Users can upgrade to tar-fs versions 3.1.1, 2.1.4, or 1.16.6 to address this vulnerability. Alternatively, the ignore option can be used to bypass non-file and non-directory entries, such as symlinks.