EUVD-2026-65311

A flaw was found in file-roller. When opening or extracting a malicious 7z or RAR archive containing a file entry with an excessively long path, file-roller's progress-line parsing copies the path into a fixed-size stack buffer using an unbounded string copy. This can trigger a stack buffer...

EUVD-2026-65301

A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Executing a manipulation of the argument destination can lead to path traversal. The attack can only be executed locally. The...

CVE-2026-78638

peerigon unzip-crx and unzip-crx-3 (up to 0.2.0 ) contain a path traversal vulnerability in the unzip function of dist/index.js (Archive Extraction component). Manipulating the destination argument allows writing files outside the intended directory. The attack requires local access with low priv...

awx: project archive extraction allows path traversal file writes

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

awx: project archive extraction allows path traversal file writes

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

CVE-2026-71364

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

CVE-2026-71364

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

CVE-2026-71364

A path traversal vulnerability in AWX 's project_archive action plugin (part of Red Hat Ansible Automation Platform ) allows arbitrary file writes on the execution node. The plugin extracts zip/tar members by joining the project directory path with the member filename without path normalization o...

CVE-2026-71364 Awx: project archive extraction allows path traversal file writes

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

EUVD-2026-64918

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

PT-2026-80905

A path traversal vulnerability was found in AWX's project archive extraction. The project archive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

OPENSUSE-SU-2026:21611-1 Security update for apptainer

This update for apptainer fixes the following issues: Changes in apptainer: - Update github.com/moby/go-archive to v0.3.0 to fix CVE-2026-17106: The tar extraction routines in moby/go-archive do not confine filesystem operations to the destination directory. A crafted archive can create or...

CVE-2026-74992

The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored X...

GHSA-JQQW-37X4-9RWJ vulnerabilities

Vulnerabilities for packages: gnutar...

EUVD-2026-62924

In Splunk SOAR versions below 8.6.0, a user who holds the Administrator role could use path traversal in the Universal Forwarder installer's archive extraction to write files outside the intended installation directory. The vulnerability is possible because the Universal Forwarder...

EUVD-2026-62923

In Splunk SOAR versions below 8.6.0, a user with app-install privileges could use path traversal during app installation to write files outside the intended temporary directory. The vulnerability is a path traversal in the archive extraction routine, which does not validate that extracted file...

CVE-2026-76359

In Splunk SOAR versions below 8.6.0, a user who holds the Administrator role could use path traversal in the Universal Forwarder installer's archive extraction to write files outside the intended installation directory. The vulnerability is possible because the Universal Forwarder...

CVE-2026-76359

CVE-2026-76359 is a path traversal vulnerability in Splunk SOAR (On-premises) versions below 8.6.0 . The Universal Forwarder installer's credentials-package extraction workflow does not verify that each archive member remains within the intended destination directory before extraction. A user wit...

CVE-2026-76359 Path Traversal through Universal Forwarder Installer Archive Extraction in Splunk SOAR

In Splunk SOAR versions below 8.6.0, a user who holds the Administrator role could use path traversal in the Universal Forwarder installer's archive extraction to write files outside the intended installation directory. The vulnerability is possible because the Universal Forwarder...

CVE-2026-61690

Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using...