9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-69874

CVE-2025-69874: nanotar is vulnerable to path traversal in parseTar() and parseTarGzip()

nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary files outside the intended extraction directory via a crafted tar archive containing path traversal sequence.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-69874

CVE-2025-69874:

9.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nanotar	npm	<= 0.2.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability described in CVE-2025-69874 is a path traversal issue within the nanotar library, specifically affecting the parseTar and parseTarGzip functions. The advisory indicates that all versions up to and including 0.2.0 are vulnerable, and no patch is currently available. My analysis of the source code from the unjs/nanotar repository confirms this. The core of the issue lies in the parseTar function located in src/parse.ts. This function is responsible for parsing tar archive data. It extracts file names from the tar headers but critically fails to perform any sanitization or validation on these names. As a result, file names containing path traversal sequences like ../ are processed and returned to the calling application as-is. If the application then uses these file names to write files to the disk, it becomes vulnerable to an attack where a specially crafted tar archive can write files outside of the intended extraction directory. The parseTarGzip function is also vulnerable as it is a simple wrapper that first decompresses the input data and then passes it to the parseTar function, thereby inheriting the same vulnerability. Since the latest code on the main branch does not contain any fixes for this issue, the vulnerability remains unpatched.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.