CVE-2026-24842

High

Advisory

Published 28 Jan 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.005; 44th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 776; of 17,787 indexed, latest versions
Container images: 800; deployed by those charts
Fix available: 1 of 2; affected packages

node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal

Carried by container images the latest versions of 776 of 17,787 indexed charts deploy, on 800 images.

Affected package	Affected versions	Fixed in	Images
tarnpm	1.0.3, 2.2.1, 2.2.2, 4.0.2+24 more	7.5.7	800
node-tardeb	1.0.3-2, 2.2.1-1, 4.4.10+ds1-2ubuntu1, 6.1.13+~cs7.0.5-3	no fix listed	6

OSV records: GHSA-34x7-hfp2-rc4v UBUNTU-CVE-2026-24842

Charts affected

776 by stars

Chart

Latest

Affected images

Radar Score

eoloplannerdreyg-jescribanob-chart-eoloplanner

0.1.0

2 of 7 See more

eoloplanner dreyg-jescribanob-chart-eoloplanner 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
oscarsotosanchez/server :v1.0	6e2e1279126b	tar@4.4.13	7.5.7
oscarsotosanchez/weatherservice :v1.0	911ec961d10b	tar@4.4.13	7.5.7

Open the chart page →

24,714

dumpstoredumpstore

0.1.1

2 of 2 See more

dumpstore dumpstore 0.1.1

2 of the 2 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
ghcr.io/manzil-infinity180/backend-dumpstore :226f28ca3efa6d3691044813cd09085e28d4a7b4	96c90cf82fdd	tar@6.2.1	7.5.7
ghcr.io/manzil-infinity180/frontend-dumpstore :226f28ca3efa6d3691044813cd09085e28d4a7b4	4e6394b715d9	tar@6.2.1	7.5.7

Open the chart page →

4,253

amundsenduyet

1.1.0

1 of 7 See more

amundsen duyet 1.1.0

1 of the 7 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
amundsendev/amundsen-frontend :2.1.1	69e7915e61c1	tar@2.2.2	7.5.7

Open the chart page →

11,174

dyff-frontenddyff-frontend

0.20.1

1 of 1 See more

dyff-frontend dyff-frontend 0.20.1

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
registry.gitlab.com/dyff/dyff-frontend :0.20.1	52549f52ae53	tar@6.2.1	7.5.7

Open the chart page →

973

self-orchestratoreclipse-aerios

1.2.0

1 of 1 See more

self-orchestrator eclipse-aerios 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
eclipseaerios/self-orchestrator :1.2.0	8b123bec5679	tar@6.2.1	7.5.7

Open the chart page →

2,397

dashboardedu

1.0.0

1 of 1 See more

dashboard edu 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
sysnet4admin/dashboard :blue	c5bd3bb1b5a6	tar@6.2.1	7.5.7

Open the chart page →

1,344

deploy-elibraryeducative-helm-bookapp

0.5.0

1 of 1 See more

deploy-elibrary educative-helm-bookapp 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
maksymhencha/educative-helm-bookapp :0.0.2	7f096a681192	tar@6.1.11	7.5.7

Open the chart page →

5,150

uptime-kumaegeback

2.0.12

1 of 1 See more

uptime-kuma egeback 2.0.12

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :2.5.0	a8610b3b4c38	tar@6.2.1	7.5.7

Open the chart page →

30,167

backend-charteks-3-tier-app-chart

0.1.0

1 of 1 See more

backend-chart eks-3-tier-app-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
arfath29/3-tier-app-backend :latest	ee0750b18406	tar@4.4.19	7.5.7

Open the chart page →

1,693

frontend-charteks-3-tier-app-chart

0.1.0

1 of 1 See more

frontend-chart eks-3-tier-app-chart 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
arfath29/3-tier-app-frontend :latest	384b3e377f47	tar@6.1.0	7.5.7

Open the chart page →

3,745

elk-stackelk-stack-test

1.0.2

1 of 9 See more

elk-stack elk-stack-test 1.0.2

1 of the 9 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
library/node :18-alpine	8d6421d663b4	tar@6.2.1	7.5.7

Open the chart page →

2,960

reddarkemmas-charts

0.0.2

1 of 1 See more

reddark emmas-charts 0.0.2

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
ghcr.io/0xemma/reddark :main	2a115e991894	tar@6.1.14	7.5.7

Open the chart page →

1,998

eolicplantseolicplants

0.1.0

2 of 7 See more

eolicplants eolicplants 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
oscarsotosanchez/server :v1.0	6e2e1279126b	tar@4.4.13	7.5.7
oscarsotosanchez/weatherservice :v1.0	911ec961d10b	tar@4.4.13	7.5.7

Open the chart page →

27,349

eoloplanner-mcaeoloplanner-mca

0.1.0

2 of 7 See more

eoloplanner-mca eoloplanner-mca 0.1.0

2 of the 7 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
oscarsotosanchez/server :v1.0	6e2e1279126b	tar@4.4.13	7.5.7
oscarsotosanchez/weatherservice :v1.0	911ec961d10b	tar@4.4.13	7.5.7

Open the chart page →

27,314

eolo-plannereolo-planner-repo

0.1.0

1 of 7 See more

eolo-planner eolo-planner-repo 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
arturisimo/server-urjc :v1.0	d8dc4430531e	tar@6.1.11	7.5.7

Open the chart page →

27,188

edp-installepmdedp

3.15.0

1 of 7 See more

edp-install epmdedp 3.15.0

1 of the 7 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
epamedp/krci-portal :0.8.0	687acf641097	tar@6.2.1	7.5.7

Open the chart page →

2,034

krci-portalepmdedp

0.8.0

1 of 1 See more

krci-portal epmdedp 0.8.0

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
epamedp/krci-portal :0.8.0	687acf641097	tar@6.2.1	7.5.7

Open the chart page →

839

hedgedocernail-hedgedoc

5.0.0

1 of 1 See more

hedgedoc ernail-hedgedoc 5.0.0

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
quay.io/hedgedoc/hedgedoc :1.10.8	abdb6b08815d	tar@6.2.1	7.5.7

Open the chart page →

1,755

blobscanethereum-helm-charts

0.1.1

1 of 1 See more

blobscan ethereum-helm-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
ethpandaops/blobscan :latest	7a9ab6370657	tar@6.1.11	7.5.7

Open the chart page →

1,329

blobscan-indexerethereum-helm-charts

0.1.1

1 of 1 See more

blobscan-indexer ethereum-helm-charts 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
ethpandaops/blobscan-indexer :latest	c58eb9ffe446	tar@4.4.19	7.5.7

Open the chart page →

2,114

blockscoutethereum-helm-charts

0.2.3

1 of 2 See more

blockscout ethereum-helm-charts 0.2.3

1 of the 2 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
blockscout/blockscout :5.1.5	c365a8f2dc12	tar@6.1.11	7.5.7

Open the chart page →

1,928

ethstatsethereum-helm-charts

0.1.4

1 of 1 See more

ethstats ethereum-helm-charts 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
skylenet/ethstats-server :pow-latest	d757cc016198	tar@6.1.11	7.5.7

Open the chart page →

1,109

ganacheethereum-helm-charts

0.1.3

1 of 2 See more

ganache ethereum-helm-charts 0.1.3

1 of the 2 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
trufflesuite/ganache-cli :v6.12.2	c062707f17f3	tar@4.4.13	7.5.7

Open the chart page →

1,608

testnet-faucetethereum-helm-charts

0.1.3

1 of 1 See more

testnet-faucet ethereum-helm-charts 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
parithoshj/testnet-faucet :9859e0d	cdca426fea6d	tar@4.4.13	7.5.7

Open the chart page →

3,005

bee-localchainethersphere

0.2.0

1 of 1 See more

bee-localchain ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
ethersphere/bee-localchain :latest	0558799ca992	tar@6.2.0	7.5.7

Open the chart page →

2,266

bzz-token-serviceethersphere

0.2.0

1 of 1 See more

bzz-token-service ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
ethersphere/bzz-token-service :latest	7624f11a72ad	tar@4.4.13	7.5.7

Open the chart page →

3,260

etherproxyethersphere

0.2.0

1 of 1 See more

etherproxy ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
ethersphere/etherproxy :1.0.0	56029b0985f4	tar@6.1.15	7.5.7

Open the chart page →

745

geth-swapethersphere

0.6.3

1 of 2 See more

geth-swap ethersphere 0.6.3

1 of the 2 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
ethersphere/bee-localchain :latest	0558799ca992	tar@6.2.0	7.5.7

Open the chart page →

4,756

multichain-proxyethersphere

0.1.0

1 of 1 See more

multichain-proxy ethersphere 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
ethersphere/multichain-proxy :0.0.2	61f5419afbcd	tar@7.4.3	7.5.7

Open the chart page →

795

onboarding-faucetethersphere

0.2.0

1 of 1 See more

onboarding-faucet ethersphere 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
ethersphere/onboarding-faucet :0.3.0	513154aab230	tar@6.1.11	7.5.7

Open the chart page →

3,320

evobotevobot

0.1.1

1 of 1 See more

evobot evobot 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
ghcr.io/drewburr-labs/evobot :3.0.0	4ddbb244c82f	tar@6.2.0	7.5.7

Open the chart page →

2,998

my-chartexpress-server

0.1.0

1 of 1 See more

my-chart express-server 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
tawfiq58/express-server :latest	c707555f6853	tar@6.1.13	7.5.7

Open the chart page →

1,113

mandefactly

0.5.16

1 of 3 See more

4,777

logentriesfairwinds-incubator

0.2.2

1 of 1 See more

logentries fairwinds-incubator 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
logentries/docker-logentries :0.2.1	f1f90a236998	tar@2.2.1	7.5.7

Open the chart page →

1,597

smeejasfanzynoodle

0.0.1

1 of 1 See more

smeejas fanzynoodle 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
fanzynoodle/smeejas :0.0.1	5f9916c1a287	tar@6.1.11	7.5.7

Open the chart page →

4,127

fickyhelmappfickyhelmapp

1.1.0

1 of 1 See more

fickyhelmapp fickyhelmapp 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
tundeficky/nodejs-app :v1.0.0	3cf9a9ce54e8	tar@6.1.14	7.5.7

Open the chart page →

3,311

findery-marketfindery-market

0.1.0

1 of 7 See more

findery-market findery-market 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
chandanteekinavar/findery-market-user-service :1.0	49e164a9a439	tar@6.1.11	7.5.7

Open the chart page →

7,691

business-api-ecosystemfiware

1.1.0

1 of 4 See more

business-api-ecosystem fiware 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
fiware/biz-ecosystem-logic-proxy :11.20.3	d551a13e8278	tar@6.2.1	7.5.7

Open the chart page →

64,192

consent-managerfiware

0.1.2

1 of 1 See more

consent-manager fiware 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
quay.io/wi_stefan/consent-manager :0.0.6	56399619568b	tar@6.2.1	7.5.7

Open the chart page →

1,795

fdsc-dashboardfiware

0.6.8

1 of 1 See more

fdsc-dashboard fiware 0.6.8

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
quay.io/seamware/fdsc-dashboard :0.6.0	f7706c316c5a	tar@6.2.1	7.5.7

Open the chart page →

705

iotagent-jsonfiware

0.1.2

1 of 1 See more

iotagent-json fiware 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
fiware/iotagent-json :3.1.0	879b21a0d36d	tar@6.1.11	7.5.7

Open the chart page →

937

iotagent-ulfiware

0.1.2

1 of 1 See more

iotagent-ul fiware 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
fiware/iotagent-ul :1.14.0	fe11f55a926d	tar@4.4.13	7.5.7

Open the chart page →

3,337

keyrockfiware

0.8.7

1 of 1 See more

3,159

canary-checkerflanksource

1.2.0

1 of 2 See more

canary-checker flanksource 1.2.0

1 of the 2 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
flanksource/canary-checker-ui :v1.4.281	764c84e550db	tar@7.4.3	7.5.7

Open the chart page →

4,661

flanksource-uiflanksource

1.4.318

1 of 1 See more

flanksource-ui flanksource 1.4.318

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
flanksource/incident-manager-ui :v1.4.318	891f21df54fb	tar@7.4.3	7.5.7

Open the chart page →

2,480

mission-controlflanksource

0.1.336

1 of 8 See more

mission-control flanksource 0.1.336

1 of the 8 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
public.ecr.aws/flanksource/incident-manager-ui :v1.4.317	fea799d4fb2f	tar@6.2.1	7.5.7

Open the chart page →

8,831

uptime-kumafluent-operator

0.1.0

1 of 1 See more

uptime-kuma fluent-operator 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :1	3d632903e6af	tar@6.2.1	7.5.7

Open the chart page →

3,474

mod-graphqlfolio-org

0.1.30

1 of 1 See more

mod-graphql folio-org 0.1.30

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
folioci/mod-graphql :latest	f0655a6a08fd	tar@6.2.1	7.5.7

Open the chart page →

1,091

flamegabe565

0.6.0

1 of 1 See more

flame gabe565 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
pawelmalak/flame :multiarch2.3.1	9f88b17692a0	tar@6.1.11	7.5.7

Open the chart page →

2,172

wekan-oldgabisonfire

0.1.2

1 of 1 See more

wekan-old gabisonfire 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-24842.

Container image	Digest	Package	Fixed in
wekanteam/wekan :v4.22	68a51f0327df	tar@4.4.13	7.5.7

Open the chart page →

5,980

Container images carrying it

800 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
wazuh/wazuh-dashboard :4.4.1	1787550d2358	tar@6.1.13	7.5.7	1
wazuh/wazuh-dashboard :4.14.4	91c8d793746f	tar@6.2.1	7.5.7	1
wazuh/wazuh-dashboard :4.14.3	91e4f0a7feed	tar@6.2.1	7.5.7	1
wekanteam/wekan :v4.22	68a51f0327df	tar@4.4.13	7.5.7	1
wettyoss/wetty :latest	7423b3d40ba2	tar@6.2.1	7.5.7	1
willwill/kube-slack :v4.1.1	d443017aae98	tar@2.2.1	7.5.7	1
winfred008/amazon :9	10a68de5b398	tar@6.2.0	7.5.7	1
wiremind/scrapoxy :latest	e7048929a676	tar@4.4.13	7.5.7	1
workadventure/playwright-synthetic-monitoring :main	92b664c2a06f	tar@6.2.1	7.5.7	1
xom4ekp2p/infini-route-attestators-public-mainnet-attester :latest	d0e0aa238b02	tar@6.2.0	7.5.7	1
xom4ekp2p/infini-route-attestators-public-mainnet-avs-webapi :latest	2745b5fd8785	tar@6.2.1	7.5.7	1
yidadaa/chatgpt-next-web :latest	eaaa469ddeeb	tar@6.2.1	7.5.7	1
ymuski/skooner :latest	67819ca511b5	tar@4.4.19	7.5.7	1
youssef11gaber10/deployment-ui-react :latest	ba6853e35c60	tar@6.1.11	7.5.7	1
yuzutech/kroki-bpmn :0.29.1	444805c4b917	tar@7.4.3	7.5.7	1
yuzutech/kroki-diagramsnet :0.29.1	b810edbf9c62	tar@7.4.3	7.5.7	1
yuzutech/kroki-excalidraw :0.29.1	57917319ea70	tar@7.4.3	7.5.7	1
yuzutech/kroki-mermaid :0.29.1	963b4acfde6e	tar@6.2.1	7.5.7	1
zazuko/trifid :2.3.7	054be137de70	tar@4.4.13	7.5.7	1
zimengxiong/excalidash-backend :0.4.27	1273af713c91	tar@6.2.1	7.5.7	1
zimengxiong/excalidash-backend :0.6.0	cbdab75f31b2	tar@6.2.1	7.5.7	1
zl0i/alertmanager-matrix-forwarder :v1.0.0	e94047931739	tar@6.1.11	7.5.7	1
zooz/predator :1.6	f491d1f7a865	tar@2.2.2	7.5.7	1
zwavejs/zwavejs2mqtt :5.0.2	15a6040fb468	tar@6.1.0	7.5.7	1
zwavejs/zwave-js-ui :11.22.3	14d018bb689e	tar@7.4.3	7.5.7	1
gcr.io/google-samples/microservices-demo/currencyservice :v0.2.3	49d458a3650f	tar@4.4.13	7.5.7	1
gcr.io/google-samples/microservices-demo/paymentservice :v0.2.3	6eb201217a8f	tar@6.1.0	7.5.7	1
ghcr.io/0xemma/reddark :main	2a115e991894	tar@6.1.14	7.5.7	1
ghcr.io/absmach/magistrala/ui-smq :latest	ea7e7f0e293e	tar@7.4.3	7.5.7	1
ghcr.io/adnoctem/lhci :1.0.1	19553e4b4033	tar@6.2.1	7.5.7	1
ghcr.io/advplyr/audiobookshelf :2.0.3	140aed2752c3	tar@6.1.11	7.5.7	1
ghcr.io/advplyr/audiobookshelf :2.32.1	a52dc5db694a	tar@6.1.15	7.5.7	1
ghcr.io/ajnart/homarr :0.16.0	737ec361ed24	tar@6.1.14	7.5.7	1
ghcr.io/ajnart/homarr :0.13.4	985456bdfb46	tar@6.1.15	7.5.7	1
ghcr.io/ajnart/homarr :latest	e103abadfb52	tar@6.1.14	7.5.7	1
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets :0.0.0-main	13e267ad7d94	tar@6.2.1	7.5.7	1
ghcr.io/aolde/lametric-nightscout-proxy :latest	7d1951b6baf5	tar@6.1.15	7.5.7	1
ghcr.io/argonix-io/argonix-api-frontend :1.0.0	d041bbf2814f	tar@6.2.1	7.5.7	1
ghcr.io/argoproj-labs/mcp-for-argocd :v0.9.0	dffc6c719d86	tar@6.2.1	7.5.7	1
ghcr.io/ashvinbambhaniya/nexus-tasks-frontend :2.0.0	fcbab3a24880	tar@6.2.1	7.5.7	1
ghcr.io/astriaorg/astrotrek :0.1.0	5889bea38e56	tar@6.2.1	7.5.7	1
ghcr.io/backstage/backstage :latest	792e262ea504	tar@6.2.1	7.5.7	1
ghcr.io/beluga-cloud/actual/actualserver :23.12.1	c8a0d5ec5a12	tar@6.1.13	7.5.7	1
ghcr.io/berriai/litellm-database :litellm_stable_release_branch-v1.75.5-stable	ab63d26a8a2c	tar@6.2.1	7.5.7	1
ghcr.io/blessingnator/keycloak-mcn-backend :2.0.5	967470f05472	tar@6.2.1	7.5.7	1
ghcr.io/bluesky-social/pds :0.4.208	637083d9369d	tar@6.2.1	7.5.7	1
ghcr.io/bluesky-social/pds :0.4.204	cbc6e3ea157d	tar@6.2.1	7.5.7	1
ghcr.io/brittonhayes/arma-reforger :latest	6fde1edc0983	tar@6.1.11	7.5.7	1
ghcr.io/bryopsida/openmct :main	38b6a50a62b2	tar@6.2.1	7.5.7	1
ghcr.io/bryopsida/patchwork :main	c01e018bced4	tar@7.4.3	7.5.7	1