CVE-2025-69874 - Vulnerability Analysis

Overview

nanotar <= 0.2.0 contains a path traversal vulnerability caused by improper validation in parseTar() and parseTarGzip(), letting remote attackers write arbitrary files outside the extraction directory via crafted tar archives.

Severity & Score

Impact

Remote attackers can write arbitrary files outside the intended directory, potentially leading to system compromise or data tampering.

Mitigation

Update to the latest version beyond 0.2.0.

References

• https://www.npmjs.com/package/nanotar
• https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69874-nanotar-Path-Traversal.md
• https://github.com/unjs/nanotar

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Feb 14, 2026

🔴 CVE-2025-69874 - Critical (9.8) nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary files outside the intended extraction directory via a crafted tar archive containing path traversal sequence. 🔗 https://www.thehackerwire.com/vulnerability/CVE-2025-69874/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner