StackRadar

CVE-2024-12905

High

Advisory

Published 27 Mar 2025In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.022
82nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
101
of 17,781 indexed, latest versions
Container images
101
deployed by those charts
Fix available
1 of 1
affected package

tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File

Carried by container images the latest versions of 101 of 17,781 indexed charts deploy, on 101 images.

Affected packageAffected versionsFixed inImages
tar-fsnpm0.5.2, 1.12.0, 1.15.3, 1.16.2+7 more1.16.4, 2.1.2, 3.0.7101
OSV records
GHSA-pq67-2wwv-3xjx

Charts affected

101 by stars
ChartLatestAffected imagesRadar Score
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2024-12905.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
tar-fs@2.1.1
2.1.2

Open the chart page →

5,459

Container images carrying it

101 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
n8nio/n8n:0.212.0a9195bc499a3
tar-fs@2.1.1
2.1.2
1
n8nio/n8n:1.33.1dd171d45102a
tar-fs@2.1.1
2.1.2
1
nocodb/nocodb:0.258.06779a4ddedf2
tar-fs@2.1.1
2.1.2
1
redis/redisinsight:2.68019fcf774631
tar-fs@2.1.1
2.1.2
1
redis/redisinsight:2.46699d341bd329
tar-fs@2.1.1
2.1.2
1
requarks/wiki:canary-2.5.2438b5865a7386c
tar-fs@2.1.1
2.1.2
1
roadiehq/community-backstage-image:latestef355bf5b639
tar-fs@2.1.1
2.1.2
1
speckle/speckle-preview-service:2.20.2-branch.testing4.134160-9fad4b21f897ca906ea
tar-fs@3.0.4
3.0.7
1
speckle/speckle-preview-service:2.21.3-branch.testing5.219631-2153bef52cad5e3293e
tar-fs@3.0.4
3.0.7
1
speckle/speckle-preview-service:2.23.14-branch.testing6.334655-b4e04ee6dee853ba74a
tar-fs@3.0.6
3.0.7
1
speckle/speckle-preview-service:2.25.10-branch.testing6.645-b125c1e787adcb20a3a
tar-fs@3.0.6
3.0.7
1
speckle/speckle-preview-service:2.17.14-branch.testing.72707.921a5f884fc39bca0c8
tar-fs@3.0.4
3.0.7
1
speckle/speckle-preview-service:2.20.6-branch.testing1.154030-9b091148f3c1ea153ba
tar-fs@3.0.4
3.0.7
1
speckle/speckle-preview-service:2.19.2-branch.hotfix-2.19.1.124125-665e7e1c102b087481a
tar-fs@2.1.1
2.1.2
1
speckle/speckle-preview-service:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbd3da0a84de98
tar-fs@2.1.1
2.1.2
1
speckle/speckle-server:2.17.14-branch.testing.72707.921a5f849d10dcdfb91
tar-fs@3.0.4
3.0.7
1
speckle/speckle-server:2.19.2-branch.hotfix-2.19.1.124125-665e7e14b6a0750d5aa
tar-fs@2.1.1
2.1.2
1
speckle/speckle-server:2.20.3-branch.hotfix-2.20.2.149555-37ea0cb52f8eabf5cea
tar-fs@3.0.4
3.0.7
1
speckle/speckle-server:2.20.2-branch.testing4.134160-9fad4b2687f43ab16f3
tar-fs@2.1.1
2.1.2
1
speckle/speckle-server:2.18.12-branch.testing3.88744-f55b34189a5872375f9
tar-fs@3.0.4
3.0.7
1
speckle/speckle-server:2.21.3-branch.testing5.219631-2153bef8fd157733393
tar-fs@3.0.4
3.0.7
1
speckle/speckle-server:2.18.11-branch.testing2.88634-335d469bf6a501b2210
tar-fs@3.0.4
3.0.7
1
speckle/speckle-server:2.20.6-branch.testing1.154030-9b09114e8413f57b327
tar-fs@3.0.4
3.0.7
1
tooljet/tooljet-ce:v1.18.0c85a4720e42e
tar-fs@2.1.1
2.1.2
1
visualregressiontracker/api:5.0.11941aeb8c8bf9
tar-fs@3.0.4
3.0.7
1
yuzutech/kroki-excalidraw:0.29.157917319ea70
tar-fs@3.0.5
3.0.7
1
zooz/predator:1.6f491d1f7a865
tar-fs@1.16.3
1.16.4
1
zwavejs/zwavejs2mqtt:5.0.215a6040fb468
tar-fs@2.1.1
2.1.2
1
ghcr.io/ajnart/homarr:0.16.0737ec361ed24
tar-fs@2.0.1
2.1.2
1
ghcr.io/ajnart/homarr:0.13.4985456bdfb46
tar-fs@2.0.1
2.1.2
1
ghcr.io/ajnart/homarr:lateste103abadfb52
tar-fs@2.0.1
2.1.2
1
ghcr.io/beluga-cloud/actual/actualserver:23.12.1c8a0d5ec5a12
tar-fs@2.1.1
2.1.2
1
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
tar-fs@3.0.6
3.0.7
1
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
tar-fs@2.1.1
2.1.2
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
tar-fs@1.16.3
1.16.4
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
tar-fs@1.16.3
1.16.4
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
tar-fs@1.16.3
1.16.4
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
tar-fs@1.16.3
1.16.4
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
tar-fs@3.0.4
3.0.7
1
ghcr.io/data-fair/data-fair:3cc9498b64b5b
tar-fs@2.1.1
2.1.2
1
ghcr.io/exposr/exposrd:v0.12.0561c8f23bdb6
tar-fs@2.1.1
2.1.2
1
ghcr.io/flaresolverr/flaresolverr:v1.2.896f8c08c0c1b
tar-fs@2.1.1
2.1.2
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
tar-fs@2.1.1
2.1.2
1
ghcr.io/jr0dd/puppeteer:v13.3.26047599cd78e
tar-fs@2.1.1
2.1.2
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
tar-fs@2.1.1
2.1.2
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
tar-fs@2.1.1
2.1.2
1
ghcr.io/oznu/homebridge:2022-07-08ff2af53897e7
tar-fs@2.1.1
2.1.2
1
ghcr.io/rodg/nodecg-base:latest31be4bf87070
tar-fs@2.1.1
2.1.2
1
ghcr.io/wiremind/grafana-pdf-exporter:v1.7dbaa8527bf4c
tar-fs@3.0.4
3.0.7
1
public.ecr.aws/aktosecurity/akto-puppeteer-replay:1.49.4_latestf1c5763d565e
tar-fs@2.1.1
2.1.2
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.