CVE-2021-32804

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the `preservePaths` flag is not set to `true`. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example `/home/user/.bashrc` would turn into `home/user/.bashrc`. This logic was insufficient when file paths contained repeated path roots such as `////home/user/.bashrc`. `node-tar` would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. `///home/user/.bashrc`) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom `onentry` method which sanitizes the `entry.path` or a `filter` method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

• CWE-22
• CWE-22

• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatch, Third Party Advisory
• https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4Patch, Third Party Advisory
• https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9Mitigation, Third Party Advisory
• https://www.npmjs.com/advisories/1770Mitigation, Third Party Advisory
• https://www.npmjs.com/package/tarProduct, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatch, Third Party Advisory
• https://github.com/npm/node-tar/commit/1f036ca23f64a547bdd6c79c1a44bc62e8115da4Patch, Third Party Advisory
• https://github.com/npm/node-tar/security/advisories/GHSA-3jfq-g458-7qm9Mitigation, Third Party Advisory
• https://www.npmjs.com/advisories/1770Mitigation, Third Party Advisory
• https://www.npmjs.com/package/tarProduct, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory

Published

Aug 3, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32797JupyterLab is a user interface for Project Jupyter which wil…9.6
• CVE-2021-32798The Jupyter notebook is a web-based notebook environment for…9.6
• CVE-2021-32800Nextcloud server is an open source, self hosted personal clo…8.1
• CVE-2021-32801Nextcloud server is an open source, self hosted personal clo…5.5
• CVE-2021-32802Nextcloud server is an open source, self hosted personal clo…9.8
• CVE-2021-32803The npm package "tar" (aka node-tar) before versions 6.1.2, …8.1
• CVE-2021-32805Flask-AppBuilder is an application development framework, bu…6.1
• CVE-2021-32806Products.isurlinportal is a replacement for isURLInPortal me…6.1
• CVE-2021-32807The module `AccessControl` defines security policies for Pyt…7.2
• CVE-2021-32808ckeditor is an open source WYSIWYG HTML editor with rich con…5.4
• CVE-2021-32809ckeditor is an open source WYSIWYG HTML editor with rich con…5.4
• CVE-2021-3281In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 befo…5.3