CVE-2026-18508

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary...

CVE-2026-18508 Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary...

CVE-2026-54727 proot-distro has a Container Isolation Bypass via Crafted Restore Archive

proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries whose linkname referenced another installed container and did not verify that the hardlink source container matched the destination container being restored, allowing a...

CVE-2026-24727

The CVE-2026-24727 entry describes an unrestricted file upload vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System (v10.3). An authenticated administrator can upload a crafted ZIP archive containing a server-executable file to achieve remote code exec...

CVE-2025-44090

An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a crafted archive file...

CVE-2025-44089

An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file...

PT-2026-63488

Name of the Vulnerable Software and Affected Versions OhSoft CoffeeZip version 4.8.0.0 Description An issue allows attackers to execute arbitrary code when a user downloads and executes a specially crafted archive file. Recommendations At the moment, there is no information about a newer version...

PT-2026-63487

Name of the Vulnerable Software and Affected Versions NCH Software ExpressZip version 11.29 Description An issue allows attackers to execute arbitrary code when a user downloads and executes a specially crafted archive file. Recommendations At the moment, there is no information about a newer...

EUVD-2025-210504

An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file...

CVE-2025-44090

An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a crafted archive file...

CVE-2025-44089

An issue in NCH Software ExpressZip v11.29 allows attackers to execute arbitrary code via downloading and executing a crafted archive file...

CVE-2025-44089

CVE-2025-44089 affects NCH Software ExpressZip v11.29. An arbitrary code execution vulnerability exists when a user downloads and executes a crafted archive file, as described in multiple sources. The issue is rated HIGH (CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) with a network attack vecto...

CVE-2025-44090

CVE-2025-44090 affects OhSoft CoffeeZip v4.8.0.0. A crafted archive file, downloaded and executed by a user, allows arbitrary code execution. The CVSSv3.1 base score is 8.8 (HIGH) with network attack vector, no privileges required, but user interaction is required. Impacts on confidentiality, int...

EUVD-2025-210503

An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a crafted archive file...

SUSE CVE-2026-59732

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as...

DEBIAN-CVE-2026-59732

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as...

CVE-2026-59732

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as...

CVE-2026-59732

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as...

CVE-2026-59732

The CVE describes a vulnerability in rclone where rclone archive extract could write extracted files outside the user-specified destination prefix when processing crafted archives containing parent path components (e.g., ../). This allowed creating or overwriting sibling objects in the same bucke...

CVE-2026-59732

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as...