hyperledger/fabric · error

tar contains the absolute or escaping path '%s'

Error message

tar contains the absolute or escaping path '%s'

What it means

Untar rejects archive entries whose name fails ValidPath — absolute paths or relative paths that escape the destination directory (e.g. '../'). This is a path-traversal (Zip Slip) protection in the external builder tar extraction.

Source

Thrown at core/container/externalbuilder/tar.go:45

		return err
	}
	defer gzr.Close()

	tr := tar.NewReader(gzr)

	for {
		header, err := tr.Next()

		if err == io.EOF {
			return nil
		}

		if err != nil {
			return errors.WithMessage(err, "could not get next tar element")
		}

		if !ValidPath(header.Name) {
			return errors.Errorf("tar contains the absolute or escaping path '%s'", header.Name)
		}

		target := filepath.Join(dst, header.Name)
		switch header.Typeflag {
		case tar.TypeDir:
			if err := os.MkdirAll(target, 0o700); err != nil {
				return errors.WithMessagef(err, "could not create directory '%s'", header.Name)
			}
		case tar.TypeReg:
			if err := os.MkdirAll(filepath.Dir(target), 0o700); err != nil {
				return errors.WithMessagef(err, "could not create directory '%s'", filepath.Dir(header.Name))
			}

			f, err := os.OpenFile(target, os.O_CREATE|os.O_RDWR, os.FileMode(header.Mode))
			if err != nil {
				return errors.WithMessagef(err, "could not create file '%s'", header.Name)
			}

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Rebuild the tar so all entry names are relative, slash-separated, and contained (no leading '/', no '..').
2. Create archives with 'tar -C <root> .' rather than absolute file paths.
3. Validate package contents before delivery; treat this as a potential security incident if the source is untrusted.
4. Sanitize entry names programmatically before archiving (strip volume/leading separators, resolve and reject escapes).

Example fix

// before
bash -c "tar -cf pkg.tar /build/output"
// after
bash -c "cd /build && tar -cf pkg.tar output"

names, err := tarHeaderNames(pkgPath)
if err != nil { return err }
for _, n := range names {
    if path.IsAbs(n) || strings.Contains(n, "..") {
        return fmt.Errorf("unsafe tar entry: %s", n)
    }
}

if err := externalbuilder.Untar(dst, r); err != nil {
    if strings.Contains(err.Error(), "absolute or escaping path") {
        return fmt.Errorf("untrusted/malformed package rejected: %w", err)
    }
    return err
}

When it happens

Trigger: Extracting a tarball that contains an entry like '/etc/passwd' or '../../foo' — i.e. any header.Name that is absolute or, after joining, resolves outside dst.

Common situations: Malicious or malformed build packages; tars created with absolute paths (tar -C misuse); hand-rolled tar generators producing '..' components; supply-chain attacks on builder inputs.

Related errors

• refusing to copy symlink %s -> %s pointing outside of source
• peer will not accept external chaincode connection %s (excep
• error inspecting next tar header
• tar entry %s is not a regular file, type %v
• did not find file '%s' in package

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/088c37290106c18d. Report an issue: GitHub.