TARmageddon Exploitable Tar Extraction Flaw Exposes Systems to Privilege Escalation
Summary A critical vulnerability known as Tarmageddon (CVE-2025-62518) impacts multiple tar extraction utilities and libraries, including GNU tar, libarchive, Python’s tarfile module, and the Rust async-tar library.
| Severity | High |
| CVSS Score | 7.8 |
| CVEs | CVE-2025-62518 |
| POC Available | Yes, public PoC and patches available (edera-dev GitHub) |
| Actively Exploited | Not confirmed widespread exploitation public PoC raises opportunistic risks |
| Exploited in Wild | No confirmed mass exploitation at time of writing |
| Advisory Version | 1.0 |
Overview
Tarmageddon (CVE-2025-62518) vulnerability Improper path sanitization and symlink-target validation during extraction enable a crafted tar archive to write files outside the intended extraction directory, leading to arbitrary file overwrite, privilege escalation, or remote code execution when executed by privileged or automated services.
| Vulnerability Name | CVE ID | Product Affected | Severity | Fixed Version |
| Tar path traversal / symlink bypass (async-tar RCE vector) | CVE-2025-62518 | GNU tar, libarchive, Python tarfile, Rust async-tar and downstream tools | High | Patches released by maintainers; reference fixes in Edera patch repository and vendor advisories |
Technical Summary
Root cause: insufficient canonicalization of file paths and incomplete sanitization of symlink targets within tar archive headers. Behavioral details: Path traversal via ../ sequences and chained symlinks allows crafted archives to escape the extraction root and overwrite system binaries, configuration files, or startup scripts.
A public proof-of-concept confirms this behavior in affected async-tar implementations. Fix: apply upstream and distribution patches that normalize paths and validate symlink targets (edera-dev patches).
Exploitability: public PoC exists for CVE-2025-62518, highest risk when automated extractions run with elevated privileges (CI/CD, build, backup). Manual extraction is lower risk. Impact: Malicious extraction can overwrite critical files, allow service takeover or remote code execution, and lead to full host compromise if run as root.
| CVE ID | System Affected | Vulnerability Details | Impact |
| CVE-2025-62518 | Tar libraries and tools async-tar, GNU tar, libarchive, Python tarfile, and any tools that use them. | Crafted tar entries can bypass path checks and write outside the extraction folder (PoC available). | Can overwrite files, allow privilege escalation/RCE if run as root, and contaminate build/CI artifacts. |
Remediation:
- Apply patches immediately — update tar libraries and utilities with vendor or distribution fixes (Edera patches where applicable).
- Disable automatic extraction of untrusted archives in gateways, ingestion services and CI/CD systems.
- Use least privilege for extraction processes — avoid root / Administrator contexts.
- Replace unsafe extraction calls (e.g., tarfile.extractall()) with secure wrappers that validate path components and reject traversal or symlink abuses.
- Sandbox extraction inside containers or VMs with strict filesystem scoping (read-only mounts, AppArmor/SELinux confinement).
- Inventory and update all images, containers, and build artifacts that bundle tar utilities or tar libraries.
Detection Guidance: Lab verification: Use the public PoC only in isolated virtual environments to validate that patched version block path traversal and symlink exploits.
SIEM / EDR indicators:
- File create/write events to sensitive paths (/etc, /usr/bin, /var, application config dirs) immediately following tar extraction processes.
- Creation of symlinks or reparse-points by tar-related processes.
- Processes invoking tar or Python extraction libraries writing outside expected extraction directories.
Conclusion:
Tarmageddon (CVE-2025-62518) is a high-risk archive extraction vulnerability that affects widely used tar utilities and libraries, including GNU tar, libarchive, Python’s tarfile, and the Rust async-tar implementation.
This vulnerability should be treated as a Priority-1 patch event for any environment performing automated or privileged tar extractions. Organizations are strongly advised to apply vendor patches immediately, enforce sandboxed extraction workflows, and implement strict least-privilege and path-validation controls to prevent arbitrary file overwrites, privilege escalation, and potential supply-chain compromise.
References:
Recent Comments