CVE-2024-12905

High

Advisory

Published 27 Mar 2025In the index since 6 Sept 2026

Severity: High; worst across findings
CVSS: 7.5; base score, highest
EPSS: 0.022; 82nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 101; of 17,781 indexed, latest versions
Container images: 101; deployed by those charts
Fix available: 1 of 1; affected package

tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File

Carried by container images the latest versions of 101 of 17,781 indexed charts deploy, on 101 images.

Affected package	Affected versions	Fixed in	Images
tar-fsnpm	0.5.2, 1.12.0, 1.15.3, 1.16.2+7 more	1.16.4, 2.1.2, 3.0.7	101

OSV records: GHSA-pq67-2wwv-3xjx

Charts affected

101 by stars

Chart

Latest

Affected images

Radar Score

wikiwikijs

3.0.0

1 of 2 See more

5,459

Container images carrying it

101 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
assistiot/dlt_api :2.0.0	e36a8922fa0c	tar-fs@2.1.1	2.1.2	3
pantsel/konga :latest	c8172b75607d	tar-fs@1.15.3	1.16.4	3
rcdelacruz/my-strapi-app :js-amd64	38007f358355	tar-fs@2.1.1	2.1.2	3
governify/assets-manager :v1.4.1	2987672448c7	tar-fs@2.1.1	2.1.2	2
koenkk/zigbee2mqtt :1.19.1	5f9129b1ffbc	tar-fs@2.1.1	2.1.2	2
l7mp/kurento-one2one-call-server :latest	fd2b2d06fff6	tar-fs@1.16.2	1.16.4	2
martinaif/backstage-k8s-demo-backend :test1	43bc40a3da0e	tar-fs@2.0.1	2.1.2	2
redis/redis-stack :7.2.0-v9	1c5f43fddcdd	tar-fs@2.1.1	2.1.2	2
requarks/wiki :2 :latest	68f0d1848261	tar-fs@2.1.1	2.1.2	2
speckle/speckle-preview-service :2.18.11-branch.testing2.88634-335d469 :2.18.12-branch.testing3.88744-f55b341	4bd113093583	tar-fs@2.1.1	2.1.2	2
activepieces/activepieces :0.23.0	c26188b44e62	tar-fs@2.1.1	2.1.2	1
actualbudget/actual-server :25.3.1	58fecd9088b7	tar-fs@2.1.1	2.1.2	1
aktosecurity/akto-puppeteer-replay :doom_latest	853e37321e6e	tar-fs@3.0.5	3.0.7	1
assistiot/cybersecurity-monitoring_ir-kbn :latest	0570b27bb7c2	tar-fs@2.1.1	2.1.2	1
assistiot/dlt_api :2.1.0	c8a170683be7	tar-fs@2.1.1	2.1.2	1
automatischio/automatisch :0.15.0	3bace7a12d5f	tar-fs@2.1.1	2.1.2	1
bicarus/mx-api-service :1.0.2-hf1	dab88659ae3b	tar-fs@2.1.1	2.1.2	1
browserless/chrome :1.48.0-chrome-stable	c81ae5585b47	tar-fs@2.1.1	2.1.2	1
chainsafe/lodestar :v1.27.0	7b9fe4aa8073	tar-fs@3.0.6	3.0.7	1
coderaiser/cloudcmd :16.6.1	b34a9775c7ce	tar-fs@2.1.1	2.1.2	1
codercom/code-server :4.11.0-debian	1e2cc688008e	tar-fs@2.1.1	2.1.2	1
codercom/code-server :3.10.2	47605610ad8d	tar-fs@2.1.1	2.1.2	1
codetogether/codetogether :latest	4348c8a38752	tar-fs@1.16.3	1.16.4	1
countly/api :25.05.4	f4cc7447c4f5	tar-fs@2.1.1	2.1.2	1
countly/countly-server :25.05.4	e3c238248f99	tar-fs@2.1.1	2.1.2	1
countly/frontend :25.05.4	2acbc11499b6	tar-fs@2.1.1	2.1.2	1
dacinfomotion/h2p :latest	68fa393b472c	tar-fs@3.0.4	3.0.7	1
directus/directus :11.1.0	e3c8bb975350	tar-fs@2.1.1	2.1.2	1
enketo/enketo-express :3.0.4	dcad9c2273f6	tar-fs@2.0.0	2.1.2	1
ethereumoptimism/data-transport-layer :0.5.56	e07968a0e686	tar-fs@2.1.1	2.1.2	1
getferdi/ferdi-server :1.3.2	6e620b85afaa	tar-fs@1.16.3	1.16.4	1
heywood8/redisinsight :2.28.0	0bc9ab313d37	tar-fs@2.1.1	2.1.2	1
ianw/quickchart :v1.7.1	dc49dd460c37	tar-fs@2.1.1	2.1.2	1
ibmcom/microclimate-file-watcher :latest	ab3fd1fdfa18	tar-fs@1.12.0	1.16.4	1
ibmcom/microclimate-portal :latest	ed5505e5c7ec	tar-fs@1.12.0	1.16.4	1
jakowenko/double-take :1.6.0	b858bac9e32a	tar-fs@2.1.1	2.1.2	1
konradkleine/docker-registry-frontend :v2	181aad54ee64	tar-fs@0.5.2	1.16.4	1
library/ghost :4.37.0	767230c0f263	tar-fs@2.1.1	2.1.2	1
library/ghost :5.79.0	83f7bf209844	tar-fs@3.0.4	3.0.7	1
library/kibana :7.17.15	0172f1c538e7	tar-fs@3.0.4	3.0.7	1
library/kibana :7.17.8	c5781ba340ef	tar-fs@2.1.1	2.1.2	1
library/kibana :7.17.3	e2e2031c15be	tar-fs@2.0.0	2.1.2	1
linuxserver/calibre :version-v5.21.0	a847b5b2d860	tar-fs@2.1.1	2.1.2	1
linuxserver/cloud9 :latest	45c5fe102ff3	tar-fs@1.16.3	1.16.4	1
linuxserver/code-server :4.10.1	a5e43a05ae79	tar-fs@2.1.1	2.1.2	1
markdegroot/unifi-protect-arm64 :latest	d8445f2a0de6	tar-fs@2.1.1	2.1.2	1
mintproject/ensemble-manager :d5656dbc01623e291564d2894c72f0e7cb2408f4	222e3b941a36	tar-fs@2.0.1	2.1.2	1
misskey/misskey :12.110.1	e08b7c478093	tar-fs@2.1.1	2.1.2	1
moonrailgun/tianji :1.11.2	b528c8f8fcc4	tar-fs@2.1.1	2.1.2	1
moreillon/food-manager :latest	e8fd856e593d	tar-fs@2.1.1	2.1.2	1