node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction. This vulnerability is fixed in 7.5.11.

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 9.2.22 or 9.3.x prior to 10.2.14. It is, therefore, affected by multiple vulnerabilities, including flaws in bundled third-party dependencies :

- Multiple server-side request forgery (SSRF) vulnerabilities in the bundled axios dependency. (CVE-2026-42043, CVE-2025-62718, CVE-2026-40175, CVE-2026-44492)

- A remote code execution vulnerability in the bundled lodash dependency. (CVE-2026-4800)

- A HTTP request smuggling vulnerability in the bundled Eclipse Jetty dependency. (CVE-2026-2332)

- A prototype pollution vulnerability in the bundled axios dependency. (CVE-2026-42264)

- Multiple injection vulnerabilities in the bundled axios dependency. (CVE-2026-44494, CVE-2026-44490, CVE-2026-42041, CVE-2026-42035, CVE-2026-42033)

- A remote code execution vulnerability in the bundled form-data dependency. (CVE-2026-12143)

- Multiple information disclosure vulnerabilities in the bundled axios dependency. (CVE-2026-44487, CVE-2026-44486)

- A file inclusion vulnerability in the bundled node-tar dependency. (CVE-2026-31802)

- An information disclosure vulnerability in Atlassian Confluence. (CVE-2026-21579)

- A denial of service vulnerability in the bundled serialize-javascript dependency. (CVE-2026-34043)

- Multiple denial of service vulnerabilities in the bundled Netty dependency. (CVE-2026-42583, CVE-2026-42587)

- Multiple denial of service vulnerabilities in the bundled axios dependency. (CVE-2026-44496, CVE-2026-44488)

- A file inclusion vulnerability in the bundled fast-uri dependency. (CVE-2026-6321)

- An injection vulnerability in the bundled fast-uri dependency. (CVE-2026-6322)

- An injection vulnerability in the bundled js-cookie dependency. (CVE-2026-46625)

- A denial of service vulnerability in the bundled picomatch dependency. (CVE-2026-33671)

- A denial of service vulnerability. (CVE-2026-48779)

- A denial of service vulnerability in Atlassian Confluence. (CVE-2026-21577)

- A remote code execution vulnerability in the bundled axios dependency. (CVE-2026-44495)

- An injection vulnerability in the bundled logback dependency. (CVE-2025-11226)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into
    creating a symlink that points outside the extraction directory by using a drive-relative symlink target
    such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction.
    This vulnerability is fixed in 7.5.11. (CVE-2026-31802)

The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4712 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4712-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     August 01, 2026                               https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : node-tar     Version        : 6.1.13+~cs7.0.5-1+deb12u1     CVE ID         : CVE-2024-28863 CVE-2026-23745 CVE-2026-26960 CVE-2026-29786

    Multiple vulnerabilities have been discovered in node-tar, a Node.js     module to read and write portable tar archives.

    CVE-2024-28863

       Generating a large number of sub-folders can consume memory on the        system and even crash the Node.js client within a few seconds using        a path with too many sub-folders inside.

    CVE-2026-23745

       When preservePaths is false, the linkpath of Link (hardlink) and        SymbolicLink entries fail to be sanitized, allowing malicious        archives to bypass the extraction root restriction, leading to        arbitrary file overwrites via hardlinks and symlink poisoning via        absolute symlink targets.

       The fix for this issue introduces CVE-2026-24842 and CVE-2026-31802.
       Both have been fixed subsequently.


    CVE-2026-26960

       An attacker-controlled archive can create a hardlink inside the        extraction directory that points to a file outside the extraction        root, enabling arbitrary file read and write as the extracting user.

    CVE-2026-29786

       An attacker-controlled archive can create a hardlink that points        outside the extraction directory by using a drive-relative link        target.

    For Debian 12 bookworm, these problems have been fixed in version     6.1.13+~cs7.0.5-1+deb12u1.

    We recommend that you upgrade your node-tar packages.

    For the detailed security status of node-tar please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-tar

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of node-tar installed on the remote host is prior to 7.5.11. It is, therefore, affected by a vulnerability:

  - node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into     creating a symlink that points outside the extraction directory by using a drive-relative symlink target     such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction.
    This vulnerability is fixed in 7.5.11. (CVE-2026-31802)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16573 advisory.

  - File Inclusion vulnerability, allows an unauthenticated attacker to get the application to display the     contents of a local file, or execute a different files already stored locally on the server.     (CVE-2026-31802)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4552 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4552-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     April 29, 2026                                https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : node-tar     Version        : 6.0.5+ds1+~cs11.3.9-1+deb11u3     CVE ID         : CVE-2024-28863 CVE-2026-23745 CVE-2026-24842 CVE-2026-26960                      CVE-2026-29786 CVE-2026-31802

    Multiple vulnerabilities have been discovered in node-tar, a Node.js     module to read and write portable tar archives.

    CVE-2024-28863

       Generating a large number of sub-folders can consume memory on the        system and even crash the Node.js client within a few seconds using        a path with too many sub-folders inside.

    CVE-2026-23745

       When preservePaths is false, the linkpath of Link (hardlink) and        SymbolicLink entries fail to be sanitized, allowing malicious        archives to bypass the extraction root restriction, leading to        arbitrary file overwrites via hardlinks and symlink poisoning via        absolute symlink targets.

       The fix for this issue introduces multiple of the following        vulnerabilties.

    CVE-2026-24842

       The security check for hardlink entries allows an attacker to craft        a malicious TAR archive that bypasses path traversal protections and        creates hardlinks to arbitrary files outside the extraction        directory.

    CVE-2026-26960

       An attacker-controlled archive can create a hardlink inside the        extraction directory that points to a file outside the extraction        root, enabling arbitrary file read and write as the extracting user.

    CVE-2026-29786

       An attacker-controlled archive can create a hardlink that points        outside the extraction directory by using a drive-relative link        target.

    CVE-2026-31802

       An attacker-controlled archive can create a hardlink that points        outside the extraction directory by using a drive-relative link        target.


    For Debian 11 bullseye, these problems have been fixed in version     6.0.5+ds1+~cs11.3.9-1+deb11u3.

    We recommend that you upgrade your node-tar packages.

    For the detailed security status of node-tar please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/node-tar

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar (npm) can be tricked into     creating a symlink that points outside the extraction directory by using a drive-relative symlink target     such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x() extraction.
    This vulnerability is fixed in 7.5.11. (CVE-2026-31802)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115694	Atlassian Confluence 9.3.x < 10.2.14 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115693	Atlassian Confluence < 9.2.22 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
464810	Echo: tar: security update to 7.5.11	Tenable Cloud Security	Echo Local Security Checks	Local	high
464810	Echo: tar: security update to 7.5.11	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
331606	Debian dla-4712 : node-tar - security update	Nessus	Debian Local Security Checks	Local	high
318798	Node.js Module node-tar < 7.5.11 Arbitrary File Overwrite	Nessus	Misc.	Local	high
318368	Atlassian Jira Service Management Data Center and Server 11.3.3 < 11.3.5 (JSDSERVER-16573)	Nessus	Misc.	Local	high
310898	Debian dla-4552 : node-tar - security update	Nessus	Debian Local Security Checks	Local	high
438634	SCA: security update for tar (GHSA-9ppj-qmqm-q256)	Tenable Cloud Security	SCA Checks	Local	high
438634	SCA: security update for tar (GHSA-9ppj-qmqm-q256)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
301684	Linux Distros Unpatched Vulnerability : CVE-2026-31802	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-31802

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high