The Red Hat Security Advisory RHSA-2026:33154 addresses multiple vulnerabilities affecting Red Hat Ceph Storage container images based on Ceph 7.1 and the ubi9 base image. Among these, CVE-2024-12905 is a significant vulnerability in the tar-fs Node.js package that permits attackers to extract malicious tar files causing unauthorized file writes or overwrites outside the intended extraction directory. This occurs due to improper handling of link resolution and pathname limitations, classified under CWE-59. The advisory lists multiple CVEs but does not provide explicit patch details, only updated container images available from the Red Hat container registry. The vulnerabilities have a high severity rating, with no known exploits in the wild. The advisory emphasizes the importance of using updated container images to mitigate these issues.

The vulnerabilities allow attackers to perform unauthorized file writes or overwrites outside intended directories, potentially leading to data corruption or unauthorized modification of files. This can compromise the integrity of the system and may allow bypassing of security mechanisms if critical files are overwritten. The impact is rated high due to the potential for significant unauthorized modifications without user interaction. No known active exploitation has been reported.

Red Hat provides updated container images for Red Hat Ceph Storage based on the latest ubi9 base image and Ceph 7.1, which address these vulnerabilities. Users should download and deploy the updated container images from the Red Hat container registry using the 'podman pull' command as recommended in the advisory. No specific patches are listed, so remediation relies on updating to the latest container images. There is no indication that no action is required or that the issue is already mitigated without updates.