StackRadarChart IndexLive demo

CVE-2026-31802

High

Advisory

Published 10 Mar 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.2; base score, highest
EPSS: 0.003; 17th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 787; of 17,781 indexed, latest versions
Container images: 811; deployed by those charts
Fix available: 1 of 2; affected packages

node-tar Symlink Path Traversal via Drive-Relative Linkpath

Carried by container images the latest versions of 787 of 17,781 indexed charts deploy, on 811 images.

Affected package	Affected versions	Fixed in	Images
tarnpm	1.0.3, 2.2.1, 2.2.2, 4.0.2+27 more	7.5.11	811
node-tardeb	1.0.3-2, 2.2.1-1, 4.4.10+ds1-2ubuntu1, 6.1.13+~cs7.0.5-3	no fix listed	6

OSV records: GHSA-9ppj-qmqm-q256 UBUNTU-CVE-2026-31802

Charts affected

787 by stars

Chart

Latest

Affected images

Radar Score

camophntom

1 of 1 See more

1,217

portraitportrait

2 of 8 See more

portrait portrait 0.2.13

2 of the 8 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
codercom/code-server :4.11.0-debian	1e2cc688008e	tar@6.1.11	7.5.11
treskon/portrait-ui :DEV-latest	e7970783bc8d	tar@6.2.1	7.5.11

Open the chart page →

31,844

prowlerprowler-app

1 of 5 See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
prowlercloud/prowler-ui :5.31.1	79ee83c8e702	tar@7.5.1	7.5.11

Open the chart page →

8,158

psa-restricted-patcherpsa-restricted-patcher

1 of 1 See more

psa-restricted-patcher psa-restricted-patcher 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
ghcr.io/bryopsida/psa-restricted-patcher :main	a53ef16b024a	tar@7.4.3	7.5.11

Open the chart page →

1,401

pumejwebapppumejnodejswebapp

1 of 1 See more

pumejwebapp pumejnodejswebapp 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
pumejlab/nodejs-webapp :latest	f563eabcb819	tar@6.1.15	7.5.11

Open the chart page →

1,164

laravel-octanerenoki-co

1 of 1 See more

laravel-octane renoki-co 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
quay.io/renokico/laravel-helm-demo :octane-0.6.0	cad83090c58f	tar@4.4.15	7.5.11

Open the chart page →

3,634

1 of 1 See more

2,449

kibanaromanow-helm-charts

1 of 1 See more

kibana romanow-helm-charts 1.7.1

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
library/kibana :7.17.8	c5781ba340ef	tar@6.1.11	7.5.11

Open the chart page →

6,879

jellyseerrrtomik-helm-charts

1 of 1 See more

jellyseerr rtomik-helm-charts 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
ghcr.io/fallenbagel/jellyseerr :2.5.2	2a611369ad1d	tar@6.2.1	7.5.11

Open the chart page →

2,823

kyoorubxkube

1 of 9 See more

kyoo rubxkube 0.1.10

1 of the 9 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
ghcr.io/zoriya/kyoo_front :4.7.1	d7f76c9c65d9	tar@6.2.1	7.5.11

Open the chart page →

30,234

uptime-kumasb-helm-charts

1 of 1 See more

uptime-kuma sb-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :2.0.2	4c364ef96aad	tar@6.2.1	7.5.11

Open the chart page →

38,107

karakeepself-hosters-by-night

1 of 1 See more

karakeep self-hosters-by-night 2.5.1

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
ghcr.io/karakeep-app/karakeep :0.27.1	abd7d6b11b1b	tar@7.4.3	7.5.11

Open the chart page →

5,213

vuiseriohub

1 of 3 See more

11,532

speckle-serverspeckle

2 of 4 See more

speckle-server speckle 2.26.3

2 of the 4 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
speckle/speckle-preview-service :2.26.3	092384dba45d	tar@6.2.1	7.5.11
speckle/speckle-server :2.26.3	79f14a2bf931	tar@6.2.1	7.5.11

Open the chart page →

10,380

splice-helmsplice-helm

1 of 13 See more

splice-helm splice-helm 0.1.7

1 of the 13 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
jupyterhub/configurable-http-proxy :3.0.0	c36cf3cc1c99	tar@2.2.1	7.5.11

Open the chart page →

1,477

statsdstatsd-airflow-smd

1 of 1 See more

statsd statsd-airflow-smd 0.1.19

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
statsd/statsd :v0.8.6	dab129e74c25	tar@4.4.6	7.5.11

Open the chart page →

4,185

stornxstornx

1 of 9 See more

11,574

1 of 1 See more

1,602

supabasesupabse

1 of 11 See more

supabase supabse 0.8.0

1 of the 11 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
supabase/postgres-meta :v0.96.6	a84cc713585e	tar@6.2.1	7.5.11

Open the chart page →

18,075

1 of 3 See more

testhub teshub 0.1.4

1 of the 3 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
testhubio/testhub-frontend :on-prem	e86c2db53be8	tar@4.4.13	7.5.11

Open the chart page →

7,517

unitycatalogunitycatalog

1 of 4 See more

unitycatalog unitycatalog 0.0.2

1 of the 4 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
ghcr.io/sdwbgn/unitycatalog-helm/docker/unitycatalog-ui :0.2.1-5d668c1	ed07e7ca098d	tar@6.2.1	7.5.11

Open the chart page →

12,581

taigaunxwares

1 of 6 See more

taiga unxwares 2026.3.8

1 of the 6 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
taigaio/taiga-events :latest	92fc0822564f	tar@6.1.11	7.5.11

Open the chart page →

9,148

prerenderutkuozdemir

1 of 1 See more

prerender utkuozdemir 1.1.2

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
tvanro/prerender-alpine :6.4.0	6909015f0328	tar@4.4.19	7.5.11

Open the chart page →

2,660

restreamerutkuozdemir

1 of 1 See more

restreamer utkuozdemir 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
datarhei/restreamer :0.6.4	655e12f9eeed	tar@4.4.13	7.5.11

Open the chart page →

2,598

vaultwarden-kubernetes-secretsvaultwarden-kubernetes-secrets

1 of 2 See more

vaultwarden-kubernetes-secrets vaultwarden-kubernetes-secrets 0.0.0-main

1 of the 2 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets :0.0.0-main	13e267ad7d94	tar@6.2.1	7.5.11

Open the chart page →

4,010

devportal-admin-uiveecode-platform

1 of 1 See more

devportal-admin-ui veecode-platform 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
veecode/devportal-admin-ui :0.4.30	c69fd286b489	tar@6.2.1	7.5.11

Open the chart page →

5,225

tdarrvhdirk

1 of 2 See more

tdarr vhdirk 5.0.5

1 of the 2 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
haveagitgat/tdarr_node :2.17.01	3ff0913202dd	tar@6.1.14	7.5.11

Open the chart page →

26,657

wikiwenerme

1 of 2 See more

3,833

scrapoxywiremind

1 of 1 See more

scrapoxy wiremind 0.3.4

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
wiremind/scrapoxy :latest	e7048929a676	tar@4.4.13	7.5.11

Open the chart page →

2,154

wraftwraft

1 of 9 See more

wraft wraft 0.1.12

1 of the 9 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
quay.io/wraft/wraft-frontend :latest	f1bbbd5e9bb9	tar@6.2.1	7.5.11

Open the chart page →

10,090

youtubedl-materialyoutubedl-material

1 of 1 See more

youtubedl-material youtubedl-material 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
tzahi12345/youtubedl-material :latest	2f943d584711	tar@6.1.11	7.5.11

Open the chart page →

9,783

qleverzazuko

1 of 2 See more

qlever zazuko 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
ghcr.io/zazukoians/qlever-ui :v0.10.0	34c7b540a095	tar@7.4.3	7.5.11

Open the chart page →

2,900

open5gsadaptivenetlab

1 of 3 See more

open5gs adaptivenetlab 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
registry.gitlab.com/infinitydon/registry/open5gs-webui :v2.2.2	fda21b0a0344	tar@4.4.13	7.5.11

Open the chart page →

25,443

adeptia-automate-mcpadeptia-automate-mcp

2 of 2 See more

adeptia-automate-mcp adeptia-automate-mcp 1.0.0

2 of the 2 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
adeptiainc/adeptia-automate-mcp-server :1.0.0	283001e83739	tar@7.4.3	7.5.11
adeptiainc/adeptia-automate-observe :1.0.0	31f295e948e6	tar@7.4.3	7.5.11

Open the chart page →

3,600

admin-portaladmin-web-portal

1 of 2 See more

admin-portal admin-web-portal 1.2.1

1 of the 2 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
soulou2019/node-server :latest	5e6ecfcc109e	tar@6.1.11	7.5.11

Open the chart page →

3,419

activepiecesadnoctem

1 of 1 See more

activepieces adnoctem 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
activepieces/activepieces :0.90.4	30c10a04fe3d	tar@6.2.1	7.5.11

Open the chart page →

1,055

lhciadnoctem

1 of 1 See more

lhci adnoctem 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
ghcr.io/adnoctem/lhci :1.0.1	19553e4b4033	tar@6.2.1	7.5.11

Open the chart page →

1,248

linkwardenadnoctem

1 of 2 See more

linkwarden adnoctem 0.5.1

1 of the 2 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
ghcr.io/linkwarden/linkwarden :v2.16.3	0664c28a039b	tar@6.2.1	7.5.11

Open the chart page →

3,820

uptime-kumaadnoctem

1 of 1 See more

uptime-kuma adnoctem 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
louislam/uptime-kuma :2.5.4	917318f9d7be	tar@6.2.1	7.5.11

Open the chart page →

30,028

akto-mini-testingakto

1 of 5 See more

akto-mini-testing akto 1.45.7

1 of the 5 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
public.ecr.aws/aktosecurity/akto-puppeteer-replay :1.49.4_latest	f1c5763d565e	tar@7.5.9	7.5.11

Open the chart page →

6,486

akto-source-code-analyserakto

1 of 3 See more

akto-source-code-analyser akto 0.1.5

1 of the 3 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
aktosecurity/akto-puppeteer-replay :doom_latest	853e37321e6e	tar@6.2.1	7.5.11

Open the chart page →

4,880

cross-seedalekc

1 of 1 See more

cross-seed alekc 7.19.0

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
ghcr.io/cross-seed/cross-seed :6.13.7	a1fed512261f	tar@6.2.1	7.5.11

Open the chart page →

1,384

excalidashalekc

1 of 2 See more

excalidash alekc 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
zimengxiong/excalidash-backend :0.6.0	cbdab75f31b2	tar@6.2.1	7.5.11

Open the chart page →

904

allure-docker-helm-chartallure-service-chart

1 of 2 See more

allure-docker-helm-chart allure-service-chart 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
frankescobar/allure-docker-service-ui :latest	4ebd8b4ef340	tar@4.4.13	7.5.11

Open the chart page →

3,647

openhab-cloudandibraeu

1 of 1 See more

openhab-cloud andibraeu 1.2.6

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
openhab/openhab-cloud :a8138a3	29dd2bac8c4b	tar@6.1.0	7.5.11

Open the chart page →

3,437

angular-chartangular-application

1 of 1 See more

angular-chart angular-application 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
ibarreche/cloud-front-ci :latest	c8970ac1c8dc	tar@4.4.19	7.5.11

Open the chart page →

3,237

angular-node-chartangular-webapp

1 of 1 See more

angular-node-chart angular-webapp 2.0.0

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
rakii8585/angular-node-webapp :latest	026082a515ac	tar@4.4.13	7.5.11

Open the chart page →

2,616

ansible-inspecansible-inspec

1 of 2 See more

ansible-inspec ansible-inspec 0.2.17

1 of the 2 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
ghcr.io/htunn/ansible-inspec :0.2.12	cd25a5cc3f1b	tar@6.2.1	7.5.11

Open the chart page →

5,558

lametric-nightscout-proxyaolde

1 of 1 See more

lametric-nightscout-proxy aolde 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
ghcr.io/aolde/lametric-nightscout-proxy :latest	7d1951b6baf5	tar@6.1.15	7.5.11

Open the chart page →

1,186

apimap-developerapimap

1 of 1 See more

apimap-developer apimap 1.4.1

1 of the 1 container images this version deploys carry CVE-2026-31802.

Container image	Digest	Package	Fixed in
apimap/developer :v1.3.1	406d3858e20c	tar@6.1.11	7.5.11

Open the chart page →

2,353

Container images carrying it

811 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
hecrom/myweatherprocessingreactclient :1.3.11	5454b54d5b28	tar@6.2.1	7.5.11	1
helga09/shoes_ukr :v1.1.1	7999bc8b77c0	tar@6.1.14	7.5.11	1
helicone/supabase-migration-runner :v2025.03.05-1	4a913936c97b	tar@6.1.15	7.5.11	1
heywood8/redisinsight :2.28.0	0bc9ab313d37	tar@6.1.13	7.5.11	1
hhaluk/crypto-watchdog :0.4.0	a6555953d941	tar@4.4.13	7.5.11	1
hirosystems/stacks-blockchain-api :8.13.2	9c98b23c1515	tar@7.4.3	7.5.11	1
hkotel/mealie :frontend-v1.0.0beta-2	3c04c0e85039	tar@6.1.11	7.5.11	1
honglab/slack-emoji-maker :v0.0.1	ca075a926fe1	tar@6.2.1	7.5.11	1
hoppscotch/hoppscotch :2024.11.0	538fe6ded4b6	tar@6.2.1	7.5.11	1
hugohg34/server :0.0.2	503e5d8960ff	tar@6.1.11	7.5.11	1
hyperledger/fabric-couchdb :0.4.10	c65891b6c237	tar@2.2.1	7.5.11	1
i4trust/pdc-portal :2.0.0	3e77858e1219	tar@4.4.13	7.5.11	1
ianw/quickchart :v1.7.1	dc49dd460c37	tar@6.1.11	7.5.11	1
ibarreche/cloud-front-ci :latest	c8970ac1c8dc	tar@4.4.19	7.5.11	1
ibarreche/cloud-indexer-ci :latest	b7a08274e69f	tar@2.2.1	7.5.11	1
ibmcom/app-nav-init :1.0.1	240ff499eb5b	tar@4.0.2	7.5.11	1
ibmcom/app-nav-ui :1.0.1	e2a86997b36b	tar@4.0.2	7.5.11	1
ibmcom/bai-admin-dev :19.0.2	02d882f2836e	tar@4.4.6	7.5.11	1
ibmcom/bai-setup-dev :19.0.2	b8e8df11072d	tar@2.2.1	7.5.11	1
ibmcom/icp-sert-bats :3.2.0	b558f2b444ae	tar@2.2.1	7.5.11	1
ibmcom/microclimate-file-watcher :latest	ab3fd1fdfa18	tar@2.2.1	7.5.11	1
ibmcom/microclimate-portal :latest	ed5505e5c7ec	tar@4.0.2	7.5.11	1
ibmcom/microclimate-theia :latest	e17bdccc5030	tar@2.2.1	7.5.11	1
ibmcom/voice-gateway-mr :1.0.5.0	0762ab1df6c1	tar@2.2.1	7.5.11	1
ilum/marquez-web :0.53.2	716437a51a6c	tar@7.5.1	7.5.11	1
improwised/erpnext-worker :v13.4.1	97280b55cbd4	tar@4.4.13	7.5.11	1
inseefrlab/shelly :cloudshell	31f04ca7436b	tar@6.1.11	7.5.11	1
instill/console :0.68.5	4cd70e2df5c6	tar@6.2.1	7.5.11	1
instructure/kinesalite :latest	34400d82f28f	tar@6.1.15	7.5.11	1
intelloop/atlas-cmms-frontend :v1.5.1	2409c2a00ab6	tar@6.2.0	7.5.11	1
interlayhq/interbtc-hydra-processor :master-2c6e16e-1637088364	423d567d47aa	tar@6.1.11	7.5.11	1
interlayhq/interbtc-hydra-processor :0.10.5	5b2c414307b9	tar@6.1.11	7.5.11	1
istio/examples-bookinfo-ratings-v1 :1.17.0	b6a6b88d3578	tar@4.4.13	7.5.11	1
jaedb/iris :latest	048cfbf58d57	tar@6.2.1	7.5.11	1
jakowenko/double-take :1.6.0	b858bac9e32a	tar@6.1.11	7.5.11	1
jayfong/yapi :1.10.2	163e5d621910	tar@4.4.13	7.5.11	1
jedi132000/nextapp :latest	dc2a81e92f23	tar@6.1.11	7.5.11	1
jesec/flood :4.7.0	3d1d0bec117a	tar@6.1.11	7.5.11	1
jesec/flood :4.6.0	60bd59cfb4eb	tar@6.1.0	7.5.11	1
jesec/rtorrent-flood :latest	f0c894ec459e	tar@6.1.0	7.5.11	1
jhidalgo3/hello-kubernetes :1.0.0.1397bf5d	dfa8628d79f5	tar@6.2.1	7.5.11	1
jkroepke/github_exporter :1.8.0	3d850992786d	tar@7.5.1	7.5.11	1
joplin/server :latest	3f7b852959aa	tar@6.1.11	7.5.11	1
joplin/server :3.0-beta	52af57880c0e	tar@6.1.11	7.5.11	1
joplin/server :2.14.2-beta	b87564ef34e9	tar@6.2.0	7.5.11	1
josepht05/nodejs-feb24 :latest	36cb0c618c94	tar@6.2.0	7.5.11	1
josepht05/titajo-docker :v1.0.0	d94024965d78	tar@6.1.15	7.5.11	1
josh5/unmanic :0.2.6	4d49c4816260	tar@6.2.0	7.5.11	1
junktext/getting-started :1.0.5	a70936c04aed	tar@4.4.19	7.5.11	1
junktext/getting-started :1.0.34	d44adf5a4da2	tar@2.2.2	7.5.11	1