PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-10173 Minitar CVE debrief

CVE-2016-10173 is a directory traversal flaw in Ruby TAR-handling gems. According to NVD, crafted TAR archive entries containing .. path segments can cause affected versions of minitar and archive-tar-minitar to write outside the intended extraction directory, which can lead to arbitrary file overwrite. The issue is rated High and is reachable without privileges or user interaction when an application processes attacker-controlled archives.

Vendor
Minitar
Product
Archive-Tar-Minitar
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-01
Original CVE updated
2026-05-13
Advisory published
2017-02-01
Advisory updated
2026-05-13

Who should care

Teams running Ruby applications or services that extract TAR archives, especially if they depend on minitar or archive-tar-minitar; package maintainers; security responders responsible for dependency risk review.

Technical summary

NVD classifies the weakness as CWE-22 and lists CVSS 3.0 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. The vulnerable ranges in the supplied NVD data are minitar through 0.5.4 and archive-tar-minitar through 0.5.2. The core failure is insufficient path normalization/sanitization during TAR extraction, allowing .. traversal to escape the target directory and overwrite arbitrary files.

Defensive priority

High. The vulnerability requires no privileges and no user interaction, and the integrity impact is high because successful exploitation can overwrite files on disk.

Recommended defensive actions

  • Upgrade minitar to a version newer than 0.5.4, or to the first fixed release identified by the upstream patch/advisory.
  • Upgrade archive-tar-minitar to a version newer than 0.5.2, or apply the referenced upstream patch if an immediate upgrade is not possible.
  • Inventory Ruby dependencies and lockfiles to find transitive use of minitar or archive-tar-minitar.
  • Treat TAR archives from untrusted or semi-trusted sources as hostile and validate extraction paths before writing files.
  • Review affected hosts for unexpected file changes in locations that archive-extraction workflows could reach.
  • Track vendor and distribution advisories referenced in the NVD record for package-specific remediation guidance.

Evidence notes

The supplied NVD record identifies the issue as CWE-22 and lists the vulnerable CPE ranges for minitar (through 0.5.4) and archive-tar-minitar (through 0.5.2). The record also cites an upstream patch commit, Debian, Gentoo, Puppet, SecurityFocus, and an issue reference tagged as Exploit/Third Party Advisory. This debrief uses only the supplied CVE metadata and reference list.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-10173 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-10173

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-10173 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-10173

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.