GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each "tar xf" in its Security Rules of Thumb; however, third-party advice leads users to run "tar xf" more than once into the same directory.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20472-1 advisory.

    This update for tar fixes the following issue:

    Security issue:

    - CVE-2025-45582: file overwrite via directory traversal in crafted TAR archives (bsc#1246399).

    Non security issue:

    - Fixes tar creating invalid tarballs when used with --delete (bsc#1246607)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:1177-1 advisory.

    This update for tar fixes the following issue:

    - CVE-2025-45582: file overwrite via directory traversal in crafted TAR archives (bsc#1246399).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to AHV-11.0.1. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-11.0.1 advisory.

  - A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages     to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized     cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code,     resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead     to undefined behavior, including compromised data confidentiality and integrity or crashes.
    (CVE-2025-5987)

  - A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in     the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
    The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The     identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended     to deploy a patch. The code maintainer replied with [f]ixed for 2.46. (CVE-2025-11083)

  - 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise     made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3.
    The same cookie name is set - but with just a slash as path (`path=\/\,`). Since this site is not     secure, the cookie *should* just be ignored. 4. A bug in the path comparison logic makes curl read outside     a heap buffer boundary The bug either causes a crash or it potentially makes the comparison come to the     wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to     expectations and depending on the memory contents immediately following the single-byte allocation that     holds the path. The presumed and correct behavior would be to plainly ignore the second set of the cookie     since it was already set as secure on a secure host so overriding it on an insecure host should not be     okay. (CVE-2025-9086)

  - Vim is an open source, command line text editor. Prior to version 9.1.1552, a path traversal issue in     Vim's tar.vim plugin can allow overwriting of arbitrary files when opening specially crafted tar archives.
    Impact is low because this exploit requires direct user interaction. However, successfully exploitation     can lead to overwriting sensitive files or placing executable code in privileged locations, depending on     the permissions of the process editing the archive. The victim must edit such a file using Vim which will     reveal the filename and the file content, a careful user may suspect some strange things going on.
    Successful exploitation could results in the ability to execute arbitrary commands on the underlying     operating system. Version 9.1.1552 contains a patch for the vulnerability. (CVE-2025-53905)

  - Vim is an open source, command line text editor. Prior to version 9.1.1551, a path traversal issue in     Vim's zip.vim plugin can allow overwriting of arbitrary files when opening specially crafted zip archives.
    Impact is low because this exploit requires direct user interaction. However, successfully exploitation     can lead to overwriting sensitive files or placing executable code in privileged locations, depending on     the permissions of the process editing the archive. The victim must edit such a file using Vim which will     reveal the filename and the file content, a careful user may suspect some strange things going on.
    Successful exploitation could results in the ability to execute arbitrary commands on the underlying     operating system. Version 9.1.1551 contains a patch for the vulnerability. (CVE-2025-53906)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the tar package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain     two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical     directory. Second, the victim must extract an archive that contains a critical file, specified via a     relative pathname that begins with the symlink name and ends with that critical file's name. Here, the     extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of     'Member name contains '..'' that would occur for a single TAR archive that attempted to specify the     critical file via a ../ approach. For example, the first archive can contain 'x -     ../../../../../home/victim/.ssh' and the second archive can contain x/authorized_keys. This can affect     server applications that automatically extract any number of user-supplied TAR archives, and were relying     on the blocking of traversal. This can also affect software installation processes in which 'tar xf' is     run more than once (e.g., when installing a package can automatically install two dependencies that are     set up as untrusted tarballs instead of official packages).(CVE-2025-45582)

Tenable has extracted the preceding description block directly from the EulerOS tar security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of AHV installed on the remote host is prior to AHV-11.0.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-11.0.0.2 advisory.

  - A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages     to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized     cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code,     resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead     to undefined behavior, including compromised data confidentiality and integrity or crashes.
    (CVE-2025-5987)

  - A vulnerability has been found in GNU Binutils 2.45. The affected element is the function elf_swap_shdr in     the library bfd/elfcode.h of the component Linker. The manipulation leads to heap-based buffer overflow.
    The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The     identifier of the patch is 9ca499644a21ceb3f946d1c179c38a83be084490. To fix this issue, it is recommended     to deploy a patch. The code maintainer replied with [f]ixed for 2.46. (CVE-2025-11083)

  - ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly     untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrusted     sources are the command line and %-sequence expansion of a configuration file. (A configuration file that     provides a complete literal username is not categorized as an untrusted source.) (CVE-2025-61984)

  - ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code     execution when a ProxyCommand is used. (CVE-2025-61985)

  - LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable     Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read     vulnerability exists in png_image_read_composite when processing palette images with     PNG_FLAG_OPTIMIZE_ALPHA enabled. The palette compositing code in png_init_read_transformations incorrectly     applies background compositing during premultiplication, violating the invariant component  alpha  257     required by the simplified PNG API. This issue has been patched in version 1.6.51. (CVE-2025-64720)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0104 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-45582:
    GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain     two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical     directory. Second, the victim must extract an archive that contains a critical file, specified via a     relative pathname that begins with the symlink name and ends with that critical file's name. Here, the     extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of     Member name contains '..' that would occur for a single TAR archive that attempted to specify the     critical file via a ../ approach. For example, the first archive can contain x ->     ../../../../../home/victim/.ssh and the second archive can contain x/authorized_keys. This can affect     server applications that automatically extract any number of user-supplied TAR archives, and were relying     on the blocking of traversal. This can also affect software installation processes in which tar xf is     run more than once (e.g., when installing a package can automatically install two dependencies that are     set up as untrusted tarballs instead of official packages).

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0895af5ebe advisory.

    Automatic update for tar-1.35-8.fc44.

    ##### **Changelog**

    ```
    * Wed Jan 21 2026 Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-8
    - Backport upstream fix for savannah bug 65838, commit 1e6ce98e (fedora#2427654)
    - added padding with zeros info message (#2089298)
    - do not report disk error as file shrank (#2089316)
    - upstream fix for savannah bug 64581, commit 51142180       (crash with TAR_OPTIONS) (fedora#2389217)
    - Backport fix for regression in the --no-overwrite-dir option       Upstream commit 4e742fc8674064a9fa00d4483d06aca48d5b0463, discussed       in https://www.mail-archive.com/bug-tar@gnu.org/msg06445.html
    - Backport upstream changes to jailify extraction directory       Includes related gnulib changes to add openat2       Fixes CVE-2025-45582 (fedora#2380007)

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:0435 advisory.

    The GNU tar program can save multiple files in an archive and restore files from an archive.

    Security Fix(es):

    * tar: Tar path traversal (CVE-2025-45582)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:0434 advisory.

    The GNU tar program can save multiple files in an archive and restore files from an archive.

    Security Fix(es):

    * tar: Tar path traversal (CVE-2025-45582)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-007:01 advisory.

    * tar: Tar path traversal (CVE-2025-45582)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:0067 advisory.

    * tar: Tar path traversal (CVE-2025-45582)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:0067 advisory.

    * tar: Tar path traversal (CVE-2025-45582)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-0067 advisory.

    [2:1.34-9]
    - Fix the last patch to solve a regression with -x and --xattrs: RHEL-136277       also, fix another tiny mistake in the patch (w/o visible consequences)

    [2:1.34-8]
    - Backport upstream changes to jailify extraction directory       Includes related gnulib changes to add openat2       Fixes CVE-2025-45582

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:0135 advisory.

    The GNU tar program can save multiple files in an archive and restore files from an archive.

    Security Fix(es):

    * tar: Tar path traversal (CVE-2025-45582)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:0067 advisory.

    The GNU tar program can save multiple files in an archive and restore files from an archive.

    Security Fix(es):

    * tar: Tar path traversal (CVE-2025-45582)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-0002 advisory.

    [2:1.35-9]
    - Fix a tiny mistake in the last patch affecting hardling extraction       (w/o visible consequences)

    [2:1.35-8]
    - Backport upstream changes to jailify extraction directory       Includes related gnulib changes to add openat2       Fixes CVE-2025-45582

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 10 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:0002 advisory.

    * tar: Tar path traversal (CVE-2025-45582)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:0002 advisory.

    * tar: Tar path traversal (CVE-2025-45582)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:0002 advisory.

    The GNU tar program can save multiple files in an archive and restore files from an archive.

    Security Fix(es):

    * tar: Tar path traversal (CVE-2025-45582)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain     two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical     directory. Second, the victim must extract an archive that contains a critical file, specified via a     relative pathname that begins with the symlink name and ends with that critical file's name. Here, the     extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of     Member name contains '..' that would occur for a single TAR archive that attempted to specify the     critical file via a ../ approach. For example, the first archive can contain x ->     ../../../../../home/victim/.ssh and the second archive can contain x/authorized_keys. This can affect     server applications that automatically extract any number of user-supplied TAR archives, and were relying     on the blocking of traversal. This can also affect software installation processes in which tar xf is     run more than once (e.g., when installing a package can automatically install two dependencies that are     set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an     otherwise-empty directory for each tar xf in its Security Rules of Thumb; however, third-party advice     leads users to run tar xf more than once into the same directory. (CVE-2025-45582)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
305840	openSUSE 16 Security Update : tar (openSUSE-SU-2026:20472-1)	Nessus	SuSE Local Security Checks	medium
304856	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : tar (SUSE-SU-2026:1177-1)	Nessus	SuSE Local Security Checks	medium
303851	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.0.1)	Nessus	Misc.	medium
301597	EulerOS 2.0 SP13 : tar (EulerOS-SA-2026-1263)	Nessus	Huawei Local Security Checks	medium
301584	EulerOS 2.0 SP13 : tar (EulerOS-SA-2026-1299)	Nessus	Huawei Local Security Checks	medium
300933	Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-11.0.0.2)	Nessus	Misc.	medium
300802	TencentOS Server 4: tar (TSSA-2026:0104)	Nessus	Tencent Local Security Checks	medium
296466	Fedora 44 : tar (2026-0895af5ebe)	Nessus	Fedora Local Security Checks	medium
283566	RHEL 9 : tar (RHSA-2026:0435)	Nessus	Red Hat Local Security Checks	medium
283537	RHEL 9 : tar (RHSA-2026:0434)	Nessus	Red Hat Local Security Checks	medium
282801	MiracleLinux 9 : tar-1.34-9.el9_7 (AXSA:2026-007:01)	Nessus	Miracle Linux Local Security Checks	medium
282635	AlmaLinux 9 : tar (ALSA-2026:0067)	Nessus	Alma Linux Local Security Checks	medium
281880	RockyLinux 9 : tar (RLSA-2026:0067)	Nessus	Rocky Linux Local Security Checks	medium
281875	Oracle Linux 9 : tar (ELSA-2026-0067)	Nessus	Oracle Linux Local Security Checks	medium
281855	RHEL 10 : tar (RHSA-2026:0135)	Nessus	Red Hat Local Security Checks	medium
281784	RHEL 9 : tar (RHSA-2026:0067)	Nessus	Red Hat Local Security Checks	medium
281764	Oracle Linux 10 : tar (ELSA-2026-0002)	Nessus	Oracle Linux Local Security Checks	medium
281751	AlmaLinux 10 : tar (ALSA-2026:0002)	Nessus	Alma Linux Local Security Checks	medium
281742	RockyLinux 10 : tar (RLSA-2026:0002)	Nessus	Rocky Linux Local Security Checks	medium
281650	RHEL 10 : tar (RHSA-2026:0002)	Nessus	Red Hat Local Security Checks	medium
247155	Linux Distros Unpatched Vulnerability : CVE-2025-45582	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-45582

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium