borg extract might modify out-of-tree files when extracting maliciously crafted archives

Impact A maliciously crafted archive could contain a symlink e.g. "evil" - "/etc" followed by an item below it "evil/passwd", or an item whose path embeds ".." e.g. "a/../../etc/passwd". When extracting such items, borg followed the symlink / resolved the "..", so it could delete or overwrite fil...

GHSA-GFP8-W835-V44J borg extract might modify out-of-tree files when extracting maliciously crafted archives

Impact A maliciously crafted archive could contain a symlink e.g. "evil" - "/etc" followed by an item below it "evil/passwd", or an item whose path embeds ".." e.g. "a/../../etc/passwd". When extracting such items, borg followed the symlink / resolved the "..", so it could delete or overwrite fil...

PT-2026-114950

Name of the Vulnerable Software and Affected Versions AUTOM8N WHM/cPanel plugin versions prior to commit 82821f7 Description An OS Command Injection exists in the 'borg restore.cgi' endpoint. OS Command Injection is a flaw that allows an attacker to execute arbitrary operating system commands on...

CVE-2026-6887

Borg SPM 2007 Sales Ended in 2008 developed by BorG Technology Corporation has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2026-6885

Borg SPM 2007 Sales Ended in 2008 developed by BorG Technology Corporation has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2026-6886

Borg SPM 2007 Sales Ended in 2008 developed by BorG Technology Corporation has a Authentication Bypass vulnerability, allowing unauthenticated remote attackers to log into the system as any user...

EUVD-2026-25213

Borg SPM 2007 Sales Ended in 2008 developed by BorG Technology Corporation has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

EUVD-2026-25211

Borg SPM 2007 Sales Ended in 2008 developed by BorG Technology Corporation has a Authentication Bypass vulnerability, allowing unauthenticated remote attackers to log into the system as any user...

EUVD-2026-25209

Borg SPM 2007 Sales Ended in 2008 developed by BorG Technology Corporation has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2026-6887

Borg SPM 2007 Sales Ended in 2008 developed by BorG Technology Corporation has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2026-6886

Borg SPM 2007 Sales Ended in 2008 developed by BorG Technology Corporation has a Authentication Bypass vulnerability, allowing unauthenticated remote attackers to log into the system as any user...

CVE-2026-6885

Borg SPM 2007 Sales Ended in 2008 developed by BorG Technology Corporation has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2026-6887

Borg SPM 2007 Sales Ended in 2008 developed by BorG Technology Corporation has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2026-6887 BorG Technology Corporation｜Borg SPM 2007 - SQL Injection

Borg SPM 2007 Sales Ended in 2008 developed by BorG Technology Corporation has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2026-6887

The CVE-2026-6887 entry concerns Borg SPM 2007 (BorG Technology Corporation). The connected sources describe a SQL Injection vulnerability that allows unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. The vulnerability impact is descr...

CVE-2026-6887 BorG Technology Corporation｜Borg SPM 2007 - SQL Injection

Borg SPM 2007 Sales Ended in 2008 developed by BorG Technology Corporation has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents...

CVE-2026-6886

CVE-2026-6886 concerns Borg SPM 2007 (BorG Technology Corporation). The provided records describe an authentication bypass that allows unauthenticated remote attackers to log in as any user. Documents list CRITICAL CVSS scores (4.0: 9.3; 3.1: 9.8) and confirm the vulnerability, but no explicit ro...

CVE-2026-6886 BorG Technology Corporation｜Borg SPM 2007 - Authentication Bypass

Borg SPM 2007 Sales Ended in 2008 developed by BorG Technology Corporation has a Authentication Bypass vulnerability, allowing unauthenticated remote attackers to log into the system as any user...

CVE-2026-6886

Borg SPM 2007 Sales Ended in 2008 developed by BorG Technology Corporation has a Authentication Bypass vulnerability, allowing unauthenticated remote attackers to log into the system as any user...

CVE-2026-6886 BorG Technology Corporation｜Borg SPM 2007 - Authentication Bypass

Borg SPM 2007 Sales Ended in 2008 developed by BorG Technology Corporation has a Authentication Bypass vulnerability, allowing unauthenticated remote attackers to log into the system as any user...