CVE-2019-13173
nodejs-fstream: File overwrite in fstream.DirWriter() function
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · May 15, 2019
Updated · November 22, 2025
Description
fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 7.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-552 · Files or Directories Accessible to External Parties