Arbitrary File Write

mobsf is vulnerable to Arbitrary file write. The vulnerability is due to improper validation of uploaded files, which allows an attacker to write arbitrary files to any directory writable by the MobSF process user...

Directory Traversal

Overview com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Directory Traversal via the ComboServlet component. An attacker can access arbitrary CSS and JS files and cause repeated loading of these files by manipulating the...

HP Support Assistant - Potential Escalation of Privilege

A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.47.41.0. The vulnerability could potentially allow a local attacker to escalate privileges via an arbitrary file write. HP has identified affected versions and the minimum version that...

Linux Distros Unpatched Vulnerability : CVE-2025-59825

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of...

Arbitrary File Write

github.com/harness/gitness is vulnerable to Arbitrary file write. The vulnerability is due to improper sanitization of the upload path, which allows an attacker to craft a malicious upload request and write arbitrary files to any location on the file system...

PT-2025-43007

Name of the Vulnerable Software and Affected Versions Atlassian Jira Software Data Center and Server versions 9.12.0 through 11.0.1 Atlassian Jira Software Data Center and Server versions 9.12.0 through 11.0.0 Description A path traversal flaw exists in Atlassian Jira Software Data Center and...

ROS-20250925-04

Vulnerability of TarFile.extractall and TarFile.extract functions of tarfile module of Python programming language interpreter CPython is related to incorrect restriction of path name of the directory with restricted directory. Python programming language interpreter CPython functions...

ROS-20250925-02

Vulnerability of TarFile.extractall and TarFile.extract functions of tarfile module of Python programming language interpreter CPython is related to incorrect restriction of path name of restricted directory. Python programming language interpreter CPython functions TarFile.extractall and...

GO-2025-3967 esm.sh has arbitrary file write via path traversal in `X-Zone-Id` header in github.com/esm-dev/esm.sh

esm.sh has arbitrary file write via path traversal in X-Zone-Id header in github.com/esm-dev/esm.sh...

GO-2025-3971 DragonFly vulnerable to arbitrary file read and write on a peer machine in d7y.io/dragonfly

DragonFly vulnerable to arbitrary file read and write on a peer machine in d7y.io/dragonfly...

@capriza/far (>=0.1.2, <=2.4.2), @cobalt-engine/cobower (2.0.0) +160 more potentially affected by CVE-2025-59343 via tar-fs (>=1.0.0, <=1.16.3)

tar-fs NPM version =1.0.0, =0.1.2, =6.0.3, =6.0.3, =6.0.3, =2.1.1, =0.10.2, =0.0.0-beta.1, =0.0.0-beta.1, =0.0.0-beta.1, =0.1.0, =0.1.0, =1.0.5, =1.1.4 - @elm-node/npm-scripts 1.0.0 - @hlsrules-test/fc-libreoffice 1.0.0 and more Source cves: CVE-2025-59343 Source advisory: SNYK:JS-TARFS-13045213...

007putra-my-bot (1.1.1), 10bis-shufersal-automation (1.0.0) +4594 more potentially affected by CVE-2025-59343 via tar-fs (>=2.0.0, <=2.1.3)

tar-fs NPM version =2.0.0, =0.2.0, =1.0.0, =1.0.0, =0.107.10, =1.19.19, =0.107.0, =0.107.0, =0.107.0, =0.69.0, =0.107.0, =0.97.1, =0.107.0, =0.107.0, =0.123.2 and more Source cves: CVE-2025-59343 Source advisory: OSV:GHSA-VJ76-C3G6-QR5V...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the Entry::unpackinraw API and the Entry::allowexternalsymlinks control which defaults to true. An attacker can write files outside the intended extraction directory and perform an arbitrary file write which can...

CVE-2025-59825

astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpackinraw API. Additionally, the Entry::allowexternalsymlinks control which...

CVE-2025-59825

CVE-2025-59825 affects astral-tokio-tar (Rust) up to v0.5.3: tar extraction can escape the target dir via Entry::unpack_in_raw and via a symlink pair that bypasses allow_external_symlinks, potentially enabling arbitrary file writes and code execution. The issue is fixed in v0.5.4; upgrading is re...

GHSA-3WGQ-WRWC-VQMV astral-tokio-tar has a path traversal in tar extraction

Impact In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpackinraw API. Additionally, the Entry::allowexternalsymlinks control which defaults to true could be bypassed via a pair of symlinks that...

PT-2025-39215

Name of the Vulnerable Software and Affected Versions astral-tokio-tar versions 0.5.3 and earlier Description astral-tokio-tar is a tar archive reading/writing library for async Rust. Tar archives may extract files outside of their intended destination directory when using the Entry::unpack in ra...

CVE-2025-10854 Symlink Following in txtai leads to arbitrary file write when loading untrusted embedding indices

The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path traversal vulnerabilities by ensuring safe filenames, it does not account for symbolic links within the tar file. An attacker is able to write a file anywhe...

CVE-2025-10854 Symlink Following in txtai leads to arbitrary file write when loading untrusted embedding indices

The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path traversal vulnerabilities by ensuring safe filenames, it does not account for symbolic links within the tar file. An attacker is able to write a file anywhe...

CVE-2025-10854

The CVE-2025-10854 issue affects the txtai framework where loading compressed tar files as embedding indices is vulnerable: the existing path traversal protection does not account for symbolic links inside the tar, allowing an attacker to write arbitrary files on the filesystem when untrusted emb...