CVE-2026-88014 rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method Fs.readZip in backend/archive/zip/zip.go accepts archive/zip.File.Name values from an untrusted central directory and exposes...

Tarmageddon-CVE-2025-62518-

Tarmageddon CVE-2025-62518 Vídeo: https://youtu.be/EYBB4BHsp9E Directorios del repositorio vulnerable-extract ejemplo mínimo reproducible, toma una ruta como argumento y extrae ese archivo a ./output malicious-payload crea un archivo malicious.tar simple con un ejemplo de contenido oculto, los...

Pluck-CMS-Pluck-4.7.16-Theme-Upload-Remote-Code-Execution-Authenticated--POC

Pluck-CMS-Pluck-4.7.16-Theme-Upload-Remote-Code-Execution-Authenticated-POC Exploit Author: Ashish Koli Shikari Vendor Homepage: https://github.com/pluck-cms/pluck Version: 4.7.16 CVE: CVE-2022-26965 Acerca de esto: Este script sube shell.tar a PluckCMS. Una aplicación extraerá el paquete que nos...

EUVD-2026-75186

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...

PT-2026-89475

Summary backend/archive mounts a zip file as a browsable, syncable rclone Fs e.g. rclone lsf :zip:downloaded.zip or rclone copy :zip:downloaded.zip dest:. Go's archive/zip package does not sanitize file.Name - it is taken verbatim from the untrusted zip's central directory. readZip in...

PT-2026-89686

Summary backend/archive mounts a zip file as a browsable, syncable rclone Fs e.g. rclone lsf :zip:downloaded.zip or rclone copy :zip:downloaded.zip dest:. Go's archive/zip package does not sanitize file.Name - it is taken verbatim from the untrusted zip's central directory. readZip in...

CVE-2026-88069

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...

CVE-2026-88069

Pandora (a file-analysis platform) contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths are not validated to ensure the destination remains within the intended extraction directory, allo...

CVE-2026-88069 Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...

CVE-2026-88069 Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis

Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image, attacker-controlled file paths could be used without ensuring that the resulting destination remained within the intended extraction directory. An attacker...

CVE-2025-56800

CVE-2025-56800 Local Authentication Bypass Vulnerability in Reolink Desktop Application 1. Overview Name : Reolink Desktop Application Version : 8.18.12 Vendor : Reolink CWE : CWE-290: Authentication Bypass by Spoofing CVSS : 5.1 MEDIUM Vector String : CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N...

winrar-exploit

Description This is my implementation of the CVE-2025-8088 Winrar exploit. It uses Alternate Data Streams ADS and path patching within the archive. When a victim extracts the infected archive, the patched ADS payload e.g., executable, powershell script, or some funny png is redirected into the...

CVE-2024-25082

⚠️ CVE-2024-25082 - FontForge ZIP Ejecución Remota de Código PoC Exploit de Prueba de Concepto para CVE-2024-25082 , una vulnerabilidad que afecta a FontForge y permite Ejecución Remota de Código RCE a través de un archivo ZIP manipulado. Este repositorio demuestra cómo se puede explotar la...

CVE-2026-86748

Snipe-IT versions before 8.7.0 contain a vulnerability in the restore endpoint where the database is wiped before the uploaded backup archive is validated. A superuser uploading a corrupted or invalid zip file triggers permanent data loss with no recovery path or rollback mechanism. The CVSS 3.1 ...

wargame-tarpioka

BubbleTea CVE-2007-4559 Directory traversal vulnerability using .tar to ../../flag path root@kitploit: BubbleTea/ ├── Dockerfile ├── flag ├── requirements.txt └── src ├── files ├── template │ └── index.html └── app.py Current Building Instructions check docker docker ps docker images docker build...

synodecrypt

SynoDecrypt Una herramienta para descifrar todos los archivos cifrados de Synology SPK, PAT, .... El trabajo de ingeniería inversa se explica en nuestra entrada de blog. Instalación root@kitploit: pip install -r requirements.txt Uso Primero debes extraer las claves de cifrado y colocarlas en un...

PoC-for-CVE-2020-28948-CVE-2020-28949

POC para CVE-2020-28948 y CVE-2020-28949 Los archivos aquí contienen el PoC para CVE-2020-28948 y CVE-2020-28949 para lograr la explotación remota. El servidor La carpeta server contiene un servidor de subida simple que utiliza la librería vulnerable ArchiveTar, ubicada en server/Archive. El...

CVE-2026-30039

CVE-2026-30039 Security advisory materials for CVE-2026-30039, a symlink-based archive extraction issue in rarfile affecting versions 4.2 and earlier. English advisory | 中文版本 Overview rarfile extracts symbolic links from attacker-controlled RAR archives without validating whether the embedded...

Blackash-CVE-2025-24071

Blackash-CVE-2025-24071 CVE-2025-24071: Fuga de hash NTLM mediante el archivo .library-ms, módulo de Metasploit 🚨 Descripción La exposición de información sensible a un actor no autorizado en el Explorador de archivos de Windows permite a un atacante no autorizado realizar spoofing a través de un...

CVE-2022-25581

CVE-2022-25581 No se encuentra en ninguna parte de la red; dejo una copia de seguridad. Script de explotación en Python para automatizar los siguientes pasos: ✅ Objetivos del script 1. Iniciar sesión en el panel de administración obtener csrf y token 2. Construir un paquete de solicitud malicioso...