CVE-2025-45582 is a path traversal vulnerability affecting GNU Tar versions up to 1.35. The vulnerability arises from a two-step extraction process involving specially crafted TAR archives. In the first step, an attacker supplies a TAR archive containing a symbolic link (symlink) entry that points to a critical directory outside the intended extraction path using directory traversal sequences (e.g., '../'). For example, the symlink 'x' might point to a sensitive directory such as '/home/victim/.ssh'. In the second step, the attacker supplies another TAR archive containing a file whose path begins with the symlink name created in the first archive and ends with the name of a critical file within the targeted directory (e.g., 'x/authorized_keys'). When extracted sequentially, the TAR utility follows the symlink and overwrites the critical file, bypassing the usual protection mechanisms that block direct '../' traversal within a single archive. This vulnerability exploits the fact that protections are applied per archive and do not consider cumulative effects across multiple extractions. The vulnerability is particularly relevant for server applications that automatically extract multiple user-supplied TAR archives without sufficient validation or isolation. The impact includes unauthorized overwriting of critical files, potentially leading to privilege escalation, unauthorized access, or service disruption. The CVSS 3.1 base score is 4.1 (medium severity), reflecting local attack vector, high attack complexity, no privileges required, user interaction required, scope changed, no confidentiality impact, low integrity impact, and low availability impact. No known exploits are reported in the wild as of the publication date. No patches are linked yet, indicating that mitigation may require manual intervention or updated versions once released.

For European organizations, this vulnerability poses a risk primarily to systems that automatically process TAR archives from untrusted or semi-trusted sources, such as web hosting providers, continuous integration/deployment pipelines, or file-sharing services. Overwriting critical files like SSH authorized_keys could allow attackers to gain persistent unauthorized access, leading to data breaches or lateral movement within networks. The medium severity score suggests limited direct confidentiality impact but notable integrity and availability concerns. Organizations relying on GNU Tar for automated extraction without additional sandboxing or validation are at risk. Given the widespread use of GNU Tar in Linux-based environments common in Europe, the vulnerability could affect a broad range of sectors including government, finance, healthcare, and critical infrastructure. The requirement for user interaction (extracting archives) and local access reduces the likelihood of remote exploitation but does not eliminate risk in multi-tenant or shared environments where users can upload archives. The bypass of traversal protections across multiple archives is a subtle attack vector that may evade detection by standard security controls, increasing the risk of unnoticed compromise.

1. Immediately audit and restrict automated TAR extraction processes to trusted sources only. 2. Implement strict validation of TAR archive contents before extraction, including checking for symlinks and directory traversal sequences across multiple archives cumulatively. 3. Use extraction tools or options that disable symlink extraction or sandbox extraction paths to prevent files from being written outside designated directories. 4. Monitor critical directories (e.g., ~/.ssh) for unauthorized changes, and implement file integrity monitoring solutions. 5. Apply principle of least privilege to processes performing extraction, ensuring they cannot overwrite critical system or user files. 6. Where possible, upgrade to a patched version of GNU Tar once available. 7. Educate users and administrators about the risks of extracting untrusted archives and enforce policies to prevent manual extraction of suspicious archives. 8. Consider containerizing or isolating extraction environments to limit the impact of potential exploitation.