Skip to content
Heist/ feed
Back to feed
High

Security advisory

Type: advisorySources: OSVCVE: CVE-2018-20835

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2018-20835
Confirmed fixed CVEs
Not specified
Updated in this feed
31 Oct 2026, 09:49 UTC · Revision 1

Source evidence

CVE-2018-20835

core-osv · Original source

Published 30 Apr 2019, 19:29 UTC

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content.

osv:CVE-2018-20835
Complete source record
{
  "id": "e433d735f131ace043fb0065aa7753bf4ecabb056ec352031c852b296dde9b88",
  "url": "https://osv.dev/vulnerability/CVE-2018-20835",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2018-20835",
    "summary": "A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content.",
    "evidence": "osv:CVE-2018-20835",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2018-20835",
      "aliases": [
        "CVE-2018-20835",
        "GHSA-x2mc-8fgj-3wmr"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/mafintosh/tar-fs",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "a35ce2fd1e91f11cf2eaf78f284c35ad214dbe04"
                },
                {
                  "fixed": "06672828e6fa29ac8551b1b6f36c852a9a3c58a2"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:tar-fs_project:tar-fs:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "1.16.2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "06672828e6fa29ac8551b1b6f36c852a9a3c58a2"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.16.1",
            "v1.16.0",
            "v1.15.3",
            "v1.15.2",
            "v1.15.1",
            "v1.15.0",
            "v1.14.0",
            "v1.13.2",
            "v1.13.1",
            "v1.13.0",
            "v1.12.0",
            "v1.11.1",
            "v1.11.0",
            "v1.10.0",
            "v1.9.0",
            "v1.8.1",
            "v1.8.0",
            "v1.7.0",
            "v1.6.0",
            "v1.5.1",
            "v1.5.0",
            "v1.4.2",
            "v1.4.1",
            "v1.4.0",
            "v1.3.0",
            "v1.2.0",
            "v1.1.0",
            "v1.0.0",
            "v0.5.2",
            "v0.5.1",
            "v0.5.0",
            "v0.4.1",
            "v0.4.0",
            "v0.3.3",
            "v0.3.2",
            "v0.3.1",
            "v0.3.0",
            "v0.2.2",
            "v0.2.1",
            "v0.2.0",
            "v0.1.8",
            "v0.1.7",
            "v0.1.5",
            "v0.1.4",
            "v0.1.3",
            "v0.1.2",
            "v0.1.1",
            "v0.1.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-20835.json"
          }
        }
      ],
      "modified": "2026-10-20T10:48:04.153637004Z",
      "provider": "osv",
      "references": [
        "https://github.com/mafintosh/tar-fs/commit/06672828e6fa29ac8551b1b6f36c852a9a3c58a2",
        "https://github.com/mafintosh/tar-fs/compare/d590fc7...a35ce2f",
        "https://hackerone.com/reports/344595"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2018-20835",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 379999,
  "published_at": "2019-04-30T19:29:03.437+00:00"
}