CVE-2018-20834 Arbitrary File Overwrite in tar
An attacker can overwrite arbitrary files on the system by crafting a malicious tarball with specific hardlink structures, affecting applications using the node-tar library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-20834?
CVE-2018-20834 is a high-severity path traversal vulnerability in n/a, published on 30 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).
Weakness: CWE-59
Which versions are affected by CVE-2018-20834?
4 open source packages ship an affected version, including tar. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
tar npm | All versions | 2.2.2 |
tar npm | All versions | 2.2.2 |
tar npm | From 3.0.0 | 4.4.2 |
tar npm | From 3.0.0 | 4.4.2 |
Products include Isaacs Tar.
How do I fix CVE-2018-20834?
Upgrade tar to a fixed version for your release line: 2.2.2 or 4.4.2.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-20834 being exploited?
There is no known exploitation of CVE-2018-20834 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2026-59873 node-tar: Decompression/parse DoS via unlimited input
- CVE-2026-23950 node-tar has Race Condition in Path Reservations via Unicode Ligature Collisions on macOS APFS
- CVE-2026-59874 node-tar: Negative tar entry size causes infinite loop in archive replace
- CVE-2026-31802 node-tar Symlink Path Traversal via Drive-Relative Linkpath
- CVE-2026-29786 node-tar: Hardlink Path Traversal via Drive-Relative Linkpath
Sources
Also known as DEBIAN-CVE-2018-20834, GHSA-j44m-qm6p-hp7m.