EUVD-2026-78126

A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. Extracting a maliciously crafted archive may allow an attacker to write arbitrary files...

CVE-2026-84534

CVE-2026-84534 is a path handling vulnerability in Apple's archive extraction functionality, where insufficient validation allowed a maliciously crafted archive to enable arbitrary file write upon extraction. The issue was fixed via improved validation in iOS 26.7 / iPadOS 26.7 , iOS 27 / iPadOS ...

7-Zip-CVE-2025-0411-POC

7-Zip-CVE-2025-0411-POC CVE-2025-0411 详细信息 “此漏洞（CVSS 评分 7.0）允许远程攻击者绕过受影响 7-Zip 安装上的 Mark-of-the-Web 保护机制。用户交互是利用此漏洞的必要条件，目标必须访问恶意页面或打开恶意文件。 该特定缺陷存在于存档文件的处理过程中。当从带有 Mark-of-the-Web 的精心构造的存档中提取文件时，7-Zip 不会将 Mark-of-the-Web 传播到提取的文件中。攻击者可以利用此漏洞在当前用户上下文中执行任意代码。” 受影响版本 24.09 之前的所有版本均被视为易受攻击。 缓解措施 “更新...

CVE-2025-0851

CVE-2025-0851 Esta vulnerabilidad ocurre en Deep Java Library un framework de código abierto para deep learning en Java al proporcionar utilidades para extraer archivos tar y zip de modelos, que se utilizan al cargar modelos, y las funciones untar y unzip presentan una vulnerabilidad de File...

CVE-2026-78299

In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk...

CVE-2026-78299

Eclipse Embedded CDT (versions 6.0 through 6.7 ) is affected by a path traversal vulnerability in its CMSIS-Pack archive extraction functionality. When a compromised CMSIS pack is extracted, files can be written to locations outside the intended pack directory , enabling arbitrary file writes to ...

CVE-2026-78299

In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk...

EUVD-2026-77465

In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk...

CVE-2026-87910

A flaw was found in the Python tarfile module. When extracting an archive containing a link on systems that do not support links, the module falls back to extracting the linked member. During this fallback, a security filter designed to prevent the extraction of certain files is not properly...

7-Zip-CVE-2025-0411-POC

7-Zip Mark-of-the-Web 绕过漏洞 CVE-2025-0411 - POC CVE-2025-0411 详情 "该漏洞（CVSS 评分 7.0）允许远程攻击者绕过受影响 7-Zip 安装上的 Mark-of-the-Web 保护机制。利用此漏洞需要用户交互，即目标必须访问恶意页面或打开恶意文件。 具体缺陷存在于存档文件的处理过程中。从带有 Mark-of-the-Web 的精心构造的存档中提取文件时，7-Zip 不会将 Mark-of-the-Web 传播到提取的文件中。攻击者可利用此漏洞在当前用户上下文中执行任意代码。" 受影响版本 24.09...

CVE-2025-55188-7z-exploit

CVE-2025-55188-7z-exploit PoC de escritura arbitraria de archivos mediante enlaces simbólicos en 7-Zip CVE-2025-55188 Descripción Esta prueba de concepto demuestra CVE-2025-55188 , una vulnerabilidad en versiones de 7-Zip anteriores a la 25.01. El fallo se produce porque 7-Zip no maneja...

PT-2026-91199

In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk...

CVE-2025-8088

CVE-2025-8088：通过 NTFS ADS 滥用实现的 WinRAR 路径遍历 📌 执行摘要 CVE-2025-8088 是 WinRAR（7.12 及更早版本）中的一个严重路径遍历漏洞。该缺陷存在于应用程序处理使用 NTFS 备用数据流（ADS） 的压缩包条目文件名的方式中。攻击者通过诱使解压引擎错误解析流边界，可绕过用户预期的解压目录，将任意文件写入 Windows Startup 文件夹等敏感位置。 漏洞详情 技术分析 该问题的核心在于 WinRAR 的路径清理逻辑与 Windows NTFS 文件系统之间的交互。 1. NTFS ADS 基础： NTFS...

Poc-CVE-2024-21542

Poc-CVE-2024-21542 概述 luigi是一个帮助您构建复杂批处理作业管道的包。它处理依赖解析、工作流管理、可视化、故障处理、命令行集成等众多功能。 由于在extractpackagesarchive函数中对目标文件路径验证不当，该包受影响版本存在通过存档提取（Zip Slip）实现任意文件写入的漏洞。 详情...

CVE-2025-6218-POC

CVE-2025-6218 Prueba de Concepto POC Resumen Este repositorio contiene una simple Prueba de Concepto POC para CVE-2025-6218 , que demuestra la explotación de una vulnerabilidad relacionada con el manejo de rutas de extracción de archivos por parte de WinRAR. El script batch de la POC crea un...

CVE-2021-3281

CVE-2021-3281 在 django.utils.archive.py 的 TarArchive 类中，存在一个目录遍历漏洞，位于 lineno:171。 函数调用 os.path.jointopath, name 没有检查参数 "name"，如果在 Windows 平台上使用该工具，就会存在目录遍历风险，POC 如下： root@kitploit: from django.utils import archive archive.extract'test.tar','.' The test.tar include file named "d:game.exe",and the...

EUVD-2026-76748

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...

CVE-2026-90445

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...

CVE-2026-90445

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...

CVE-2026-90445

CVE-2026-90445 is a path traversal vulnerability in an interface that accepts file uploads from authenticated users . The root cause is that uploaded archives are extracted without validating that file paths remain within the intended destination directory, allowing an attacker to write files to ...