Skip to main content
New to Testkube? Unleash the power of cloud native testing in Kubernetes with Testkube. Get Started >

bitnami-mongodb-7.0.20_linux_arm64

digestsha256:53b16c30fdf0e3e1425a33b8d363012c24314ea35f54239653f1a061a3a488be
vulnerabilitiescritical: 0 high: 1 medium: 0 low: 0
platformlinux/arm64
size207 MB
packages650
critical: 0 high: 1 medium: 0 low: 0 tar-fs 2.1.2 (npm)

pkg:npm/tar-fs@2.1.2
high 8.7: CVE--2025--48387 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected range
>=2.0.0
<2.1.3
Fixed version2.1.3
CVSS Score8.7
CVSS VectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS Score0.063%
EPSS Percentile20th percentile
Description

Impact​

v3.0.8, v2.1.2, v1.16.4 and below

Patches​

Has been patched in 3.0.9, 2.1.3, and 1.16.5

Workarounds​

You can use the ignore option to ignore non files/directories.

  ignore (_, header) {
    // pass files & directories, ignore e.g. symlinks
    return header.type !== 'file' && header.type !== 'directory'
  }

Credit​

Thank you Caleb Brown from Google Open Source Security Team for reporting this in detail.