CVE-2025-8749

Path Traversal vulnerability in API Endpoint in Mobile Industrial Robots MiR Software Versions prior to 3.0.0 on MiR Robots allows authenticated users to extract files from the robot file system via a crafted API request...

zip

This is a robust ZIP decoder with defenses against various types of malicious archive signatures, including dangerous compression ratios, spec deviations, and ambiguous UTF-8 filenames. The decoder is implemented in JavaScript and is designed to be used in a Node.js environment. It provides a ran...

PT-2025-55131

Уязвимость функции extract file архиватора GNU Tar связана с чтением за допустимыми границами буфера данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании...

Linux smb_extract_folioq_to_rdma DoS

The vulnerability of the smbextractfolioqtordma function in the Linux operating system is related to the violation of the buffer boundary. Exploiting this vulnerability can allow an attacker to cause a service failure...

RUSTSEC-2025-0172 `zip-extract` is unmaintained; use the `zip >= 2.4.0` crate instead

The zip-extract crate has been explicitly deprecated by its author on Jul 16, 2025, and the repository was archived on Sep 8, 2025. The author added deprecation notices README stating that the functionality is now available directly in the zip crate via ZipArchive::extract available since zip 0.6...

arfur (>=0.0.1, <=0.0.2), arfur-build (>=0.0.1, <=0.0.2) +20 more potentially affected by unknown CVE via zip-extract (>=0.1.3, <=0.2.3)

zip-extract CARGO version =0.1.3, =0.0.1, =0.0.1, =0.0.1, =0.1.3, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0172...

`zip-extract` is unmaintained; use the `zip >= 2.4.0` crate instead

The zip-extract crate has been explicitly deprecated by its author on Jul 16, 2025, and the repository was archived on Sep 8, 2025. The author added deprecation notices README stating that the functionality is now available directly in the zip crate via ZipArchive::extract available since zip 0.6...

PT-2025-62919

The zip-extract crate has been explicitly deprecated by its author on Jul 16, 2025, and the repository was archived on Sep 8, 2025. The author added deprecation notices README stating that the functionality is now available directly in the zip crate via ZipArchive::extract available since zip 0.6...

OESA-2025-1767 erlang security update

Erlang is a general-purpose programming language and runtime environment. Erlang has built-in support for concurrency, distribution and fault tolerance. Erlang is used in several large telecommunication systems from Ericsson. Security Fixes: Improper Limitation of a Pathname to a Restricted...

PT-2025-40805

Name of the Vulnerable Software and Affected Versions allegroai/clearml version v2.0.1 Description A flaw exists in the handling of symbolic and hard links within the safe extract function, leading to a path traversal issue. This can result in arbitrary file writes outside the intended directory...

cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory

A flaw was found in the Python tarfile module. This vulnerability allows attackers to bypass extraction filters, enabling symlink targets to escape the destination directory and allowing unauthorized modification of file metadata via the use of TarFile.extract or TarFile.extractall with the filte...

cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory

A flaw was found in the Python tarfile module. This vulnerability allows attackers to bypass extraction filters, enabling symlink targets to escape the destination directory and allowing unauthorized modification of file metadata via the use of TarFile.extract or TarFile.extractall with the filte...

SUSE CVE-2025-38179

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix maxsge overflow in smbextractfolioqtordma This fixes the following problem: 749.901015 T8673 run fstests cifs/001 at 2025-06-17 09:40:30 750.346409 T9870...

DEBIAN-CVE-2025-38179

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix maxsge overflow in smbextractfolioqtordma This fixes the following problem: 749.901015 T8673 run fstests cifs/001 at 2025-06-17 09:40:30 750.346409 T9870...

cpython: python: Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory

A flaw was found in the Python tarfile module. This vulnerability allows attackers to bypass extraction filters, enabling symlink targets to escape the destination directory and allowing unauthorized modification of file metadata via the use of TarFile.extract or TarFile.extractall with the filte...

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal via the Extract method. An attacker can gain remote code execution by uploading specially crafted archive files containing path traversal sequences in filenames, resulting in files being written to arbitrary...

cognicept-shell (>=1.7.3, <=1.8.1.dev2), hstools (0.0.1) +3 more potentially affected by CVE-2025-50181 via urllib3 (1.25.4)

urllib3 PYPI version 1.25.4 is affected by a known vulnerability. The following packages have a transitive dependency on urllib3 and may be impacted: - cognicept-shell =1.7.3, =1.1.0, =0.0.103, =0.0.114 - ua-extract 1.1.4 Source cves: CVE-2025-50181 Source advisory: OSV:GHSA-PQ67-6M6Q-MJ2V...

PT-2025-27954

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to the version that includes the fix for the max sge overflow in smb extract folioq to rdma Description: A vulnerability has been resolved in the Linux kernel related to the max sge overflow in smb extract folioq t...

SUSE CVE-2025-4748

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Erlang OTP stdlib modules allows Absolute Path Traversal, File Manipulation. This vulnerability is associated with program files lib/stdlib/src/zip.erl and program routines zip:unzip/1, zip:unzip/2,...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: btrfs: Fixed an assertion failure that occurred when splitting an ordered extent after a transaction abort. If a direct IO write transaction abort occurs, we mark all existing ordered extents with the BTRFSORDEREDIOERR flag done...