PYSEC-2026-469 PraisonAI vulnerable to arbitrary file write via path traversal in `praisonai recipe unpack`

| Field | Value | |---|---| | Severity | Critical | | Type | Path traversal -- arbitrary file write via tar.extract without member validation | | Affected | src/praisonai/praisonai/cli/features/recipe.py:1170-1172 | Summary cmdunpack in the recipe CLI extracts .praison tar archives using raw...

perl-Archive-Tar security update

2.38-6.1 - Fix CVE-2026-42496: validate symlink and hardlink targets in secure extract mode - Resolves: RHEL-181662...

perl-Archive-Tar security update

2.30-2 - Fix CVE-2026-42496: validate symlink and hardlink targets in secure extract mode - Resolves: RHEL-181654 2.30-1 - 2.30 bump 2.28-1 - 2.28 bump - Fixes CVE-2018-12015 directory traversal bug 1588761 2.26-6 - Do not run optional test on RHEL 2.26-5 - Rebuilt for...

Linux Distros Unpatched Vulnerability : CVE-2026-29509

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Patool before 4.0.5 contains a path traversal vulnerability in the safeextract function in patoolib/programs/pytarfile.py when running on Python before 3.12,...

EulerOS 2.0 SP15 : python-requests (EulerOS-SA-2026-2465)

According to the versions of the python-requests packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths utility function uses a predictable filename...

CVE-2026-49991

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely...

DEBIAN-CVE-2026-29509

Patool before 4.0.5 contains a path traversal vulnerability in the safeextract function in patoolib/programs/pytarfile.py when running on Python before 3.12, where the iswithindirectory helper uses os.path.commonprefix for character-level string comparison instead of path-level comparison, allowi...

CVE-2026-29509

Patool before 4.0.5 contains a path traversal vulnerability in the safeextract function in patoolib/programs/pytarfile.py when running on Python before 3.12, where the iswithindirectory helper uses os.path.commonprefix for character-level string comparison instead of path-level comparison, allowi...

CVE-2026-49991 RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely...

CVE-2026-49991

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely...

EUVD-2026-39879

Patool before 4.0.5 contains a path traversal vulnerability in the safeextract function in patoolib/programs/pytarfile.py when running on Python before 3.12, where the iswithindirectory helper uses os.path.commonprefix for character-level string comparison instead of path-level comparison, allowi...

CVE-2026-29509

Patool before 4.0.5 contains a path traversal vulnerability in the safeextract function in patoolib/programs/pytarfile.py when running on Python before 3.12, where the iswithindirectory helper uses os.path.commonprefix for character-level string comparison instead of path-level comparison, allowi...

CVE-2026-29509 Patool < 4.0.5 Path Traversal via safe_extract() Function

Patool before 4.0.5 contains a path traversal vulnerability in the safeextract function in patoolib/programs/pytarfile.py when running on Python before 3.12, where the iswithindirectory helper uses os.path.commonprefix for character-level string comparison instead of path-level comparison, allowi...

CVE-2026-29509

Patool before 4.0.5 is vulnerable to a path traversal in the safe_extract() function (patoolib/programs/py_tarfile.py). The is_within_directory() helper uses character-level comparison via os.path.commonprefix(), not path-level checks, allowing a crafted archive member path to bypass containment ...

GHSA-JMR9-QJV8-65GV extract-zip unvalidated symlink path traversal

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory...

0.extends.wechat (>=1.0.51, <=1.0.65), 007putra-my-bot (1.1.1) +17597 more potentially affected by CVE-2026-56876 via extract-zip (>=2.0.0, <=2.0.1)

extract-zip NPM version =2.0.0, =1.0.51, =0.0.1, =1.0.0, =0.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.4 and more Source cves: CVE-2026-56876 Source advisory: OSV:GHSA-JMR9-QJV8-65GV...

extract-zip unvalidated symlink path traversal

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory...

CVE-2026-56876

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory...

0.app1 (1.0.52), 0.edsql (>=1.0.49, <=1.0.50) +29699 more potentially affected by CVE-2026-56876 via extract-zip (>=1.0.3, <=2.0.1)

extract-zip NPM version =1.0.3, =1.0.49, =1.0.49, =1.0.49, =1.0.51, =0.0.1, =0.8.0 - 10bis-shufersal-automation 1.0.0 - 123-movies 1.0.0 - 16promax-monitor 1.0.0 - 192.168.0.172 4.6.1 and more Source cves: CVE-2026-56876 Source advisory: SNYK:JS-EXTRACTZIP-17660777...

org.webjars.npm:karma-phantomjs-launcher (>=1.0.1, <=1.0.4), org.webjars.npm:phantomjs-prebuilt (2.1.16) +1 more potentially affected by CVE-2026-56876 via org.webjars.npm:extract-zip (>=1.7.0, <=2.0.1)

org.webjars.npm:extract-zip MAVEN version =1.7.0, =1.0.1, =3.3.0, =7.1.0 Source cves: CVE-2026-56876 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-17660778...