8.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24884

CVE-2026-24884: Compressing Vulnerable to Arbitrary File Write via Symlink Extraction

Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can cause subsequent file entries to be written to arbitrary locations on the host file system. Depending on the extractor’s handling of existing files, this behavior may allow overwriting sensitive files or creating new files in security-critical locations. This issue has been patched in versions 1.10.4 and 2.0.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24884

CVE-2026-24884:

8.4

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
compressing	npm	= 2.0.0	2.0.1
compressing	npm	<= 1.10.3	1.10.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an arbitrary file write in the compressing npm package, caused by improper handling of symbolic links in TAR archives. The root cause is that the library does not validate the target of a symlink during extraction. An attacker can create a malicious TAR archive containing a symlink that points to a directory outside the intended extraction destination (e.g., ../../../../tmp). When the library processes a subsequent file entry intended for that symlinked directory, it follows the link and writes the file to the arbitrary location, leading to a path traversal vulnerability.

The analysis of the provided patches (8d16c196c7f1888fc1af957d9ff36117247cea6c and ce1c0131c401c071c77d5a1425bf8c88cfc16361) pinpoints the vulnerable code in lib/utils.js. The fix is implemented within the makeUncompressFn function, which is a factory for the uncompression logic. The patch introduces a new isPathWithinParent function to check if a given path is within the destination directory. This check is then applied to both regular file entries and, most importantly, to the targets of symbolic links.

The function makeUncompressFn is identified as the key function because it contains the vulnerable logic that was modified. While the user-facing API is compressing.tar.uncompress, the actual processing of the tar entries happens inside an anonymous function created by makeUncompressFn. A runtime profiler would show execution within this logic when the vulnerability is triggered. The patch directly modifies this function to add the necessary security validation, confirming it as the location of the vulnerability.

Vulnerable functions

makeUncompressFn

lib/utils.js

The function `makeUncompressFn` creates the core uncompression logic for tar archives. The vulnerability existed within an anonymous function inside it, specifically in the 'entry' event handler for the tar stream. This handler processed symbolic link entries without validating their target paths. This allowed a malicious TAR archive to create a symlink pointing outside the intended extraction directory. Subsequent file entries in the archive could then leverage this symlink to write files to arbitrary locations on the filesystem. The patch mitigates this by adding a check to ensure the resolved symlink target path is within the bounds of the extraction directory.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.