Compressing Vulnerable to Arbitrary File Write via Symlink Extraction

Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outside the intended extraction directory, an attacker can cause subsequent file entries to be written to arbitrary locations on the host file system. Depending on the extractor’s handling of existing files, this behavior may allow overwriting sensitive files or creating new files in security-critical locations. This issue has been patched in versions 1.10.4 and 2.0.1.

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

在文件访问前对链接解析不恰当(链接跟随)

compressing 后置链接漏洞

compressing是node_modules开源的一个压缩和解压缩工具库。 Compressing 1.10.3及之前版本和2.0.0版本存在后置链接漏洞，该漏洞源于提取TAR归档时未验证符号链接目标，可能导致任意文件写入。

N/A

N/A