CVE-2026-90445

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...

CVE-2026-87910 tarfile hardlink fallback ignores custom extraction filter rejection via None

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

binwalk

Binwalk Binwalk 是一款快速、易用的工具，用于分析、逆向工程和提取固件镜像。 EOL 通知 此分支的创建是为了修复 binwalk v2 的一些悬而未决的问题，并使其保持良好的状态。它已实现了帮助用户和发行版打包者的目的。然而，由于原作者最近用 Rust 重写了 binwalk 并再次积极开发，因此不再需要维护 binwalk v2。用户和贡献者应迁移到 binwalk v3。这个新版本还提供了 Rust 库，请参阅 https://github.com/ReFirmLabs/binwalk/wiki/Using-the-Rust-Library。 因此，此仓库将在 202...

EUVD-2026-75787

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction...

PT-2026-90513

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...

CVE-2026-80424

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction...

CVE-2026-80424

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is affected by a path traversal vulnerability (CWE-22) that occurs during archive extraction , allowing a remote authenticated attacker to create arbitrary files. The flaw is rated CVSS 9.1 (Critical) with a scope change, reflecting high integri...

CVE-2025-4138-poc

CVE-2025-4138 Auto-Sudo 生成器 一个 Python 脚本，用于生成利用 CVE-2025-4138 / CVE-2025-4517 （通过 PATHMAX 截断实现的路径遍历）的恶意 tar 归档。 成功利用此漏洞可让攻击者绕过 tarfile 提取过滤器，并向文件系统写入任意文件。该工具专门针对 /etc/sudoers.d/，以授予无密码 root 权限。 用法 生成漏洞利用载荷： root@kitploit: python3 exploit.py -o exploit.tar 选项 -o, --output：必填 。恶意 tar 文件的保存路径。 -u,...

Pluck-CMS-Pluck-4.7.16-Theme-Upload-Remote-Code-Execution-Authenticated--POC

Pluck-CMS-Pluck-4.7.16-Theme-Upload-Remote-Code-Execution-Authenticated-POC 漏洞利用作者: Ashish Koli Shikari 厂商主页: https://github.com/pluck-cms/pluck 版本: 4.7.16 CVE: CVE-2022-26965 关于此工具: 此脚本将 shell.tar 上传到 PluckCMS。应用程序将解压该 包，从而允许我们访问 Webshell。 用法 : python3 exploit.py 示例: python3 exploit.py 127.0.0.1...

EUVD-2026-75186

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...

CVE-2026-88069

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...

CVE-2026-88069

Pandora (a file-analysis platform) contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths are not validated to ensure the destination remains within the intended extraction directory, allo...

CVE-2026-88069 Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...

CVE-2026-88069 Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...

winrar-exploit

描述 这是我对 CVE-2025-8088 Winrar 漏洞的实现。它利用备用数据流（ADS）以及压缩包内的路径修补技术。当受害者解压被感染的压缩包时，被修补的 ADS 载荷（例如，可执行文件、PowerShell 脚本或某个有趣的 png）会被重定向到目标路径（通常是启动文件夹）。在下次系统启动时，由于载荷位于启动文件夹中，它会被自动执行。 缺点 你需要知道受害者的 Windows 用户名，才能访问其启动文件夹。这通常很容易获取，所以不算大问题。 Winrar 已在最新版本中修补了此漏洞，因此该漏洞仅在接下来的 5-6 个月内有效。（大多数人已经多年未更新） 仓库 需要 zlib 支...

openSUSE 16 Security Update : cpio (openSUSE-SU-2026:21747-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21747-1 advisory. - CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended...

cve-2022-41352

cve-2022-41352 poc.tarを生成 root@kitploit: $ chmod +x cpiopocgen.py $ ./cpiopocgen.py cpioに中指を立てる root@kitploit: $ cd /tmp $ mkdir -p poc/a/b copy poc.tar to /tmp/poc/a/b/ $ cd /tmp/poc/a/b/ $ cpio -i poc.tar $ ls -al ../ total 16 drwxrwxr-x 3 xabino xabino 4096 ott 10 14:56 . drwxrwxr-x 3 xabino...

CVE-2026-43637-cornac

CVE-2026-43637：Cornac 中 extractarchive 的路径遍历（Tar Slip）漏洞 严重性： 高危，CVSS 4.0 8.8 ；严重，CVSS 3.1 9.1 （由 VulnCheck（CNA）指定） 向量（v4.0）： CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N 向量（v4.0）： CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H 受影响版本： cornac 2.6.0 修复版本： 2.6.0 CWE：...

CVE-2025-8088

POC for CVE 2025-8088 WinRAR -o...

CVE-2026-81939

A Zip Slip vulnerability in the SonicWall Network Security Manager NSM On-Prem file upload and archive processing functionality allows an attacker to extract files outside the intended destination directory using a specially crafted archive...