5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24909

CVE-2026-24909: vlt Mishandles Path Sanitization for tar

vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24909

CVE-2026-24909:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@vltpkg/tar	npm	< 1.0.0-rc.10	1.0.0-rc.10

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue in the @vltpkg/tar package, allowing an attacker to write files outside the intended extraction directory by crafting a malicious tar archive. The root cause of the vulnerability lies in the checkFs function within src/tar/src/unpack.ts, which performed inadequate sanitization of file paths from the tar headers. The patch, found in commit ff8d4099a1929772cea2adf131285e90ede6b0dd, replaces the weak regex-based validation with a robust check that resolves the file's path against the target extraction directory and ensures it remains within that directory's bounds. The unpackUnzipped function is the consumer of the vulnerable checkFs function and the executor of the unsafe file write operations. Therefore, both checkFs (due to the logical flaw) and unpackUnzipped (due to its role in the exploit chain) are identified as the key vulnerable functions that would appear in a runtime profile during exploitation.

Vulnerable functions

checkFs

src/tar/src/unpack.ts

The `checkFs` function contained insufficient path sanitization logic. It relied on a regular expression to detect path traversal sequences like '..', which could be bypassed. It also had weak checks against absolute paths. This allowed an attacker to craft a tar archive with malicious file paths that, when extracted, would write files outside the intended destination directory.

unpackUnzipped

src/tar/src/unpack.ts

This function is responsible for iterating through tar file entries and extracting them. It calls the `checkFs` function to validate each file path. Because it trusted the flawed output of the vulnerable `checkFs` function, it would proceed to perform file system write operations (`write` and `mkdirp`) using the malicious, unsanitized path. This makes it a critical function in the execution flow of a path traversal attack.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.