CVE-2025-69874
Published: 11 February 2026
Description
nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary files outside the intended extraction directory via a crafted tar archive containing path traversal sequence.
Mitigating Controls (NIST 800-53 r5)AI
Timely remediation of the path traversal flaw in nanotar through 0.2.0 directly eliminates the vulnerability in parseTar() and parseTarGzip() functions.
Validates information inputs such as tar archive paths to block path traversal sequences and prevent arbitrary file writes outside the extraction directory.
Enforces least privilege on processes using nanotar to limit the scope of arbitrary file writes even if path traversal succeeds.
Security SummaryAI
CVE-2025-69874 is a path traversal vulnerability (CWE-22) in the nanotar npm package through version 0.2.0. The flaw affects the parseTar() and parseTarGzip() functions, which do not properly sanitize path traversal sequences in crafted tar archives, enabling extraction of files outside the intended directory.
Remote, unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required, as indicated by its CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). By supplying a malicious tar archive, attackers can achieve arbitrary file writes on the target system, potentially leading to full compromise through overwrite of critical files.
Mitigation details and further analysis are available in the primary advisory at https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69874-nanotar-Path-Traversal.md, along with the project repository at https://github.com/unjs/nanotar and package page at https://www.npmjs.com/package/nanotar.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal vulnerability in nanotar allows remote unauthenticated arbitrary file writes via crafted tar archives, directly enabling exploitation of public-facing applications.