StackRadar

CVE-2025-59343

High

Advisory

Published 24 Sept 2025In the index since 6 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.006
44th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
125
of 17,781 indexed, latest versions
Container images
122
deployed by those charts
Fix available
1 of 1
affected package

tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball

Carried by container images the latest versions of 125 of 17,781 indexed charts deploy, on 122 images.

Affected packageAffected versionsFixed inImages
tar-fsnpm0.5.2, 1.12.0, 1.15.3, 1.16.2+12 more1.16.6, 2.1.4, 3.1.1122
OSV records
GHSA-vj76-c3g6-qr5v

Charts affected

125 by stars
ChartLatestAffected imagesRadar Score
qbittorrentcfi20176.13.31 of 1See more

qbittorrent cfi2017 6.13.3

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
ghcr.io/cross-seed/cross-seed:6.13.381afafdd96a5
tar-fs@2.1.2
2.1.4

Open the chart page →

1,338
audiobookshelfcharts-derwitt-devVerified publisher1.1.01 of 1See more

audiobookshelf charts-derwitt-dev 1.1.0

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.36.0180acad33d69
tar-fs@2.1.2
2.1.4

Open the chart page →

1,722
audiobookshelfchristianhuthVerified publisher2.4.01 of 1See more

audiobookshelf christianhuth 2.4.0

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.36.0180acad33d69
tar-fs@2.1.2
2.1.4

Open the chart page →

1,722
countlychristianhuthVerified publisher5.2.12 of 3See more

countly christianhuth 5.2.1

2 of the 3 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
countly/api:25.05.4f4cc7447c4f5
tar-fs@2.1.1
2.1.4
countly/frontend:25.05.42acbc11499b6
tar-fs@2.1.1
2.1.4

Open the chart page →

7,295
cloudpremcloudprem0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad1 of 6See more

cloudprem cloudprem 0.0.0-build.00306ba7288bb8d46dd8c6190af79ef5b6fbdbad

1 of the 6 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
tar-fs@2.1.1
2.1.4

Open the chart page →

18,293
coderstudio-strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

coderstudio-strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
tar-fs@2.1.1
2.1.4

Open the chart page →

5,141
docker-composecoderstudio-strapi-devVerified publisher0.0.11 of 3See more

docker-compose coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
tar-fs@2.1.1
2.1.4

Open the chart page →

5,141
strapi-devcoderstudio-strapi-devVerified publisher0.0.11 of 3See more

strapi-dev coderstudio-strapi-dev 0.0.1

1 of the 3 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
rcdelacruz/my-strapi-app:js-amd6438007f358355
tar-fs@2.1.1
2.1.4

Open the chart page →

5,141
dev-code-servercosmoVerified publisher0.0.71 of 2See more

dev-code-server cosmo 0.0.7

1 of the 2 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
tar-fs@2.1.2
2.1.4

Open the chart page →

14,559
quickchartcowboysysopVerified publisher5.0.01 of 1See more

quickchart cowboysysop 5.0.0

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
ianw/quickchart:v1.7.1dc49dd460c37
tar-fs@2.1.1
2.1.4

Open the chart page →

5,488
kongacreate-databases0.1.01 of 1See more

konga create-databases 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
pantsel/konga:latestc8172b75607d
tar-fs@1.15.3
1.16.6

Open the chart page →

5,209
dapr-agentsdapr-agents-devVerified publisher0.1.51 of 31See more

dapr-agents dapr-agents-dev 0.1.5

1 of the 31 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
ghcr.io/kagent-dev/doc2vec/mcp:1.1.14ace1de323f4a
tar-fs@2.1.3
2.1.4

Open the chart page →

22,193
datacube-wpsdatacube-charts0.9.01 of 1See more

datacube-wps datacube-charts 0.9.0

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
opendatacube/wps:latest80df355a660b
tar-fs@2.1.3
2.1.4

Open the chart page →

6,172
homarrdelerVerified publisher1.0.11 of 1See more

homarr deler 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
ghcr.io/ajnart/homarr:0.13.4985456bdfb46
tar-fs@2.0.1
2.1.4

Open the chart page →

1,924
directusdirectusVerified publisher0.9.101 of 4See more

directus directus 0.9.10

1 of the 4 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
directus/directus:11.1.0e3c8bb975350
tar-fs@2.1.1
2.1.4

Open the chart page →

4,551
dumpstoredumpstore0.1.11 of 2See more

dumpstore dumpstore 0.1.1

1 of the 2 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
tar-fs@3.1.0
3.1.1

Open the chart page →

4,251
exposrexposr0.12.01 of 1See more

exposr exposr 0.12.0

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
ghcr.io/exposr/exposrd:v0.12.0561c8f23bdb6
tar-fs@2.1.1
2.1.4

Open the chart page →

570
double-takegeek-cookbookVerified publisher2.3.21 of 1See more

double-take geek-cookbook 2.3.2

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
jakowenko/double-take:1.6.0b858bac9e32a
tar-fs@2.1.1
2.1.4

Open the chart page →

12,222
flaresolverrgeek-cookbookVerified publisher5.4.21 of 1See more

flaresolverr geek-cookbook 5.4.2

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
ghcr.io/flaresolverr/flaresolverr:v1.2.896f8c08c0c1b
tar-fs@2.1.1
2.1.4

Open the chart page →

1,870
puppeteergeek-cookbookVerified publisher1.2.21 of 1See more

puppeteer geek-cookbook 1.2.2

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
ghcr.io/jr0dd/puppeteer:v13.3.26047599cd78e
tar-fs@2.1.1
2.1.4

Open the chart page →

15,730
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.81 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

1 of the 5 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
library/kibana:7.17.150172f1c538e7
tar-fs@3.0.4
3.1.1

Open the chart page →

34,754
ghostghostVerified publisher0.1.01 of 4See more

ghost ghost 0.1.0

1 of the 4 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
library/ghost:5.79.083f7bf209844
tar-fs@3.0.4
3.1.1

Open the chart page →

9,019
Governify-Bluejaygovernify0.1.01 of 12See more

Governify-Bluejay governify 0.1.0

1 of the 12 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
tar-fs@2.1.1
2.1.4

Open the chart page →

22,512
Governify-Falcongovernify0.1.01 of 10See more

Governify-Falcon governify 0.1.0

1 of the 10 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
governify/assets-manager:v1.4.12987672448c7
tar-fs@2.1.1
2.1.4

Open the chart page →

24,319
h2ph2pVerified publisher1.0.11 of 1See more

h2p h2p 1.0.1

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
dacinfomotion/h2p:latest68fa393b472c
tar-fs@3.0.4
3.1.1

Open the chart page →

1,713
zigbee2mqtthelm-chart-roeiVerified publisher1.19.01 of 1See more

zigbee2mqtt helm-chart-roei 1.19.0

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
koenkk/zigbee2mqtt:1.19.15f9129b1ffbc
tar-fs@2.1.1
2.1.4

Open the chart page →

2,173
streamsheetshelm-chartsVerified publisher0.2.34 of 8See more

streamsheets helm-charts 0.2.3

4 of the 8 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
tar-fs@1.16.3
1.16.6
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
tar-fs@1.16.3
1.16.6
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
tar-fs@1.16.3
1.16.6
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
tar-fs@1.16.3
1.16.6

Open the chart page →

89,959
backstagehelm-charts-nr0.1.151 of 2See more

backstage helm-charts-nr 0.1.15

1 of the 2 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
martinaif/backstage-k8s-demo-backend:test143bc40a3da0e
tar-fs@2.0.1
2.1.4

Open the chart page →

8,213
automatischhelmforgeVerified publisher1.3.71 of 4See more

automatisch helmforge 1.3.7

1 of the 4 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
automatischio/automatisch:0.15.03bace7a12d5f
tar-fs@2.1.1
2.1.4

Open the chart page →

5,769
countlyhelmforgeVerified publisher1.2.61 of 3See more

countly helmforge 1.2.6

1 of the 3 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
countly/countly-server:25.05.4e3c238248f99
tar-fs@2.1.1
2.1.4

Open the chart page →

18,813
wikijshomeenterpriseinc1.4.01 of 1See more

wikijs homeenterpriseinc 1.4.0

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
requarks/wiki:canary-2.5.2438b5865a7386c
tar-fs@2.1.1
2.1.4

Open the chart page →

4,253
ibm-microclimateibm-charts0.1.02 of 8See more

ibm-microclimate ibm-charts 0.1.0

2 of the 8 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
ibmcom/microclimate-file-watcher:latestab3fd1fdfa18
tar-fs@1.12.0
1.16.6
ibmcom/microclimate-portal:latested5505e5c7ec
tar-fs@1.12.0
1.16.6

Open the chart page →

57,669
dtlinfradao0.0.11 of 1See more

dtl infradao 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
ethereumoptimism/data-transport-layer:0.5.56e07968a0e686
tar-fs@2.1.1
2.1.4

Open the chart page →

4,944
backstageirembo-backstage-helmVerified publisher1.0.51 of 3See more

backstage irembo-backstage-helm 1.0.5

1 of the 3 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
roadiehq/community-backstage-image:latestef355bf5b639
tar-fs@2.1.1
2.1.4

Open the chart page →

7,232
n8njanip81-helm-chartsVerified publisher0.1.41 of 1See more

n8n janip81-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
n8nio/n8n:1.86.08b39ed5a2de9
tar-fs@2.1.2
2.1.4

Open the chart page →

5,826
actual-budgetk8s-chartsVerified publisher0.2.31 of 1See more

actual-budget k8s-charts 0.2.3

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
actualbudget/actual-server:25.3.158fecd9088b7
tar-fs@2.1.1
2.1.4

Open the chart page →

2,611
audiobookshelfk8s-home-lab-repo2.0.11 of 1See more

audiobookshelf k8s-home-lab-repo 2.0.1

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
ghcr.io/advplyr/audiobookshelf:2.32.1a52dc5db694a
tar-fs@2.1.2
2.1.4

Open the chart page →

2,350
kenerkener-chart0.0.71 of 1See more

kener kener-chart 0.0.7

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
tar-fs@2.1.2
2.1.4

Open the chart page →

5,228
visual-regression-trackerkokuwa5.1.01 of 4See more

visual-regression-tracker kokuwa 5.1.0

1 of the 4 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
visualregressiontracker/api:5.0.11941aeb8c8bf9
tar-fs@3.0.4
3.1.1

Open the chart page →

9,098
tooljetkrzwiatrzyk1.1.11 of 2See more

tooljet krzwiatrzyk 1.1.1

1 of the 2 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
tooljet/tooljet-ce:v1.18.0c85a4720e42e
tar-fs@2.1.1
2.1.4

Open the chart page →

5,410
jellyseerrlbenicio-communityVerified publisher0.1.01 of 1See more

jellyseerr lbenicio-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:latest4538137bc5af
tar-fs@2.1.2
2.1.4

Open the chart page →

3,555
nodecg-chartmarathon-charts0.1.51 of 2See more

nodecg-chart marathon-charts 0.1.5

1 of the 2 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
ghcr.io/rodg/nodecg-base:latest31be4bf87070
tar-fs@2.1.1
2.1.4

Open the chart page →

7,315
backstagemcwarmanVerified publisher0.10.101 of 2See more

backstage mcwarman 0.10.10

1 of the 2 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
tar-fs@2.1.1
2.1.4

Open the chart page →

9,668
MINTmint8.0.21 of 15See more

MINT mint 8.0.2

1 of the 15 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
mintproject/ensemble-manager:d5656dbc01623e291564d2894c72f0e7cb2408f4222e3b941a36
tar-fs@2.0.1
2.1.4

Open the chart page →

43,341
tianjimsgbyte0.1.171 of 2See more

tianji msgbyte 0.1.17

1 of the 2 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
moonrailgun/tianji:1.11.2b528c8f8fcc4
tar-fs@2.1.1
2.1.4

Open the chart page →

4,560
cloudcmdmy0nVerified publisher0.0.31 of 1See more

cloudcmd my0n 0.0.3

1 of the 1 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
coderaiser/cloudcmd:16.6.1b34a9775c7ce
tar-fs@2.1.1
2.1.4

Open the chart page →

3,128
example-dev-toolsnoygal0.2.81 of 3See more

example-dev-tools noygal 0.2.8

1 of the 3 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
linuxserver/cloud9:latest45c5fe102ff3
tar-fs@1.16.3
1.16.6

Open the chart page →

27,465
ferdi-serverobeoneVerified publisher1.0.31 of 2See more

ferdi-server obeone 1.0.3

1 of the 2 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
getferdi/ferdi-server:1.3.26e620b85afaa
tar-fs@1.16.3
1.16.6

Open the chart page →

1,866
nocodbone-acre-fundVerified publisher0.4.61 of 3See more

nocodb one-acre-fund 0.4.6

1 of the 3 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
nocodb/nocodb:0.258.06779a4ddedf2
tar-fs@2.1.1
2.1.4

Open the chart page →

4,219
flomesh-consoleopenshift0.70.0-30-ubi81 of 2See more

flomesh-console openshift 0.70.0-30-ubi8

1 of the 2 container images this version deploys carry CVE-2025-59343.

Container imageDigestPackageFixed in
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
tar-fs@2.1.1
2.1.4

Open the chart page →

9,968

Container images carrying it

122 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
tar-fs@3.0.4
3.1.1
1
ghcr.io/data-fair/data-fair:3cc9498b64b5b
tar-fs@2.1.1
2.1.4
1
ghcr.io/data-fair/notify:3c739b74dabb0
tar-fs@2.1.2
2.1.4
1
ghcr.io/exposr/exposrd:v0.12.0561c8f23bdb6
tar-fs@2.1.1
2.1.4
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
tar-fs@2.1.2
2.1.4
1
ghcr.io/flaresolverr/flaresolverr:v1.2.896f8c08c0c1b
tar-fs@2.1.1
2.1.4
1
ghcr.io/formancehq/console:console-on.v1.1.1a4d32c2f68b3
tar-fs@2.1.1
2.1.4
1
ghcr.io/jr0dd/puppeteer:v13.3.26047599cd78e
tar-fs@2.1.1
2.1.4
1
ghcr.io/kagent-dev/doc2vec/mcp:1.1.14ace1de323f4a
tar-fs@2.1.3
2.1.4
1
ghcr.io/karakeep-app/karakeep:0.27.1abd7d6b11b1b
tar-fs@2.1.3
2.1.4
1
ghcr.io/karakeep-app/karakeep:0.33.2b069e4307dec
tar-fs@2.1.3
2.1.4
1
ghcr.io/karakeep-app/karakeep:0.26.0f575a34ed3f8
tar-fs@2.1.3
2.1.4
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
tar-fs@2.1.1
2.1.4
1
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
tar-fs@3.1.0
3.1.1
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
tar-fs@2.1.1
2.1.4
1
ghcr.io/oznu/homebridge:2022-07-08ff2af53897e7
tar-fs@2.1.1
2.1.4
1
ghcr.io/rajnandan1/kener:3.2.182b993cb232eb
tar-fs@2.1.2
2.1.4
1
ghcr.io/rodg/nodecg-base:latest31be4bf87070
tar-fs@2.1.1
2.1.4
1
ghcr.io/wiremind/grafana-pdf-exporter:v1.7dbaa8527bf4c
tar-fs@3.0.4
3.1.1
1
public.ecr.aws/aktosecurity/akto-puppeteer-replay:1.49.4_latestf1c5763d565e
tar-fs@2.1.1
2.1.4
1
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
tar-fs@2.1.3
2.1.4
1
quay.io/flomesh/flomesh-console-ubi8:0.70.0-30ce6938ff6709
tar-fs@2.1.1
2.1.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.