8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-31802

CVE-2026-31802: node-tar Symlink Path Traversal via Drive-Relative Linkpath

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-31802

CVE-2026-31802:

8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
tar	npm	<= 7.5.10	7.5.11

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue in the node-tar library, specifically in how it handles symbolic links with drive-relative paths during extraction. The provided commit f48b5fa3b7985ddab96dc0f2125a4ffc9911b6ad directly addresses this flaw. The changes are located in src/unpack.ts, inside a private method of the Unpack class used for handling symbolic links. This method's name is defined by a JavaScript Symbol with the description 'symlink', which would likely appear in a profiler as Unpack.[symlink]. The patch modifies the path traversal check to use the same processed path that is later used for creating the symlink, thus closing the loophole. The vulnerable function is the one that contains this flawed logic, as it's the one processing the malicious entry from the tar file. The execution flow during exploitation would involve the main extraction function tar.x() instantiating an Unpack object, which then processes the tar entries and calls this vulnerable internal method for any symbolic link entry.

Vulnerable functions

Unpack.[symlink]

src/unpack.ts

The method, identified by the symbol 'symlink' within the Unpack class, is responsible for handling symbolic link entries from a tar archive. The vulnerability existed because the path traversal validation was performed on the original linkpath from the archive, while the symlink was created using a modified path where absolute path indicators (like drive letters) were stripped. This discrepancy allowed an attacker to craft a path like 'C:../../../etc/passwd' which would pass the validation check but would be written to the filesystem as '../../../etc/passwd', thus traversing outside the intended extraction directory.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.