CVE-2026-29509

Patool before 4.0.5 contains a path traversal vulnerability in the safeextract function in patoolib/programs/pytarfile.py when running on Python before 3.12, where the iswithindirectory helper uses os.path.commonprefix for character-level string comparison instead of path-level comparison, allowi...

CVE-2026-49991

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely...

EUVD-2026-39865

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely...

CVE-2026-49991 RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely...

CVE-2026-49991 RustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection

RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely...

CVE-2026-29509

Patool before 4.0.5 is vulnerable to a path traversal in the safe_extract() function (patoolib/programs/py_tarfile.py). The is_within_directory() helper uses character-level comparison via os.path.commonprefix(), not path-level checks, allowing a crafted archive member path to bypass containment ...

EUVD-2026-39879

Patool before 4.0.5 contains a path traversal vulnerability in the safeextract function in patoolib/programs/pytarfile.py when running on Python before 3.12, where the iswithindirectory helper uses os.path.commonprefix for character-level string comparison instead of path-level comparison, allowi...

CVE-2026-29509

Patool before 4.0.5 contains a path traversal vulnerability in the safeextract function in patoolib/programs/pytarfile.py when running on Python before 3.12, where the iswithindirectory helper uses os.path.commonprefix for character-level string comparison instead of path-level comparison, allowi...

CVE-2026-29509 Patool < 4.0.5 Path Traversal via safe_extract() Function

Patool before 4.0.5 contains a path traversal vulnerability in the safeextract function in patoolib/programs/pytarfile.py when running on Python before 3.12, where the iswithindirectory helper uses os.path.commonprefix for character-level string comparison instead of path-level comparison, allowi...

0.extends.wechat (>=1.0.51, <=1.0.65), 007putra-my-bot (1.1.1) +17095 more potentially affected by CVE-2026-56876 via extract-zip (>=2.0.0, <=2.0.1)

extract-zip NPM version =2.0.0, =1.0.51, =1.0.0, =0.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.2.2 and more Source cves: CVE-2026-56876 Source advisory: GHSA-JMR9-QJV8-65GV...

0.extends.wechat (>=1.0.51, <=1.0.65), 007putra-my-bot (1.1.1) +17095 more potentially affected by CVE-2026-56876 via extract-zip (>=2.0.0, <=2.0.1)

extract-zip NPM version =2.0.0, =1.0.51, =1.0.0, =0.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.2.2 and more Source cves: CVE-2026-56876 Source advisory: OSV:GHSA-JMR9-QJV8-65GV...

extract-zip unvalidated symlink path traversal

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory...

GHSA-JMR9-QJV8-65GV extract-zip unvalidated symlink path traversal

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory...

CVE-2026-56876

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory...

0.app1 (1.0.52), 0.edsql (>=1.0.49, <=1.0.50) +29185 more potentially affected by CVE-2026-56876 via extract-zip (>=1.0.3, <=2.0.1)

extract-zip NPM version =1.0.3, =1.0.49, =1.0.49, =1.0.49, =1.0.51, =1.0.65 - 007putra-my-bot 1.1.1 - 0wcc9yywcywy 1.0.0 - 0wu8yw8by8cw 1.0.0 - 10bis-shufersal-automation 1.0.0 - 123-movies 1.0.0 - 16promax-monitor 1.0.0 - 192.168.0.172 4.6.1 - 20190403-utils 1.0.0 and more Source cves:...

org.webjars.npm:karma-phantomjs-launcher (>=1.0.1, <=1.0.4), org.webjars.npm:phantomjs-prebuilt (2.1.16) +1 more potentially affected by CVE-2026-56876 via org.webjars.npm:extract-zip (>=1.7.0, <=2.0.1)

org.webjars.npm:extract-zip MAVEN version =1.7.0, =1.0.1, =3.3.0, =7.1.0 Source cves: CVE-2026-56876 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-17660778...

CVE-2026-56876

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory...

CVE-2025-32423

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.32, there is a DoS vulnerability in ExtractTextInformationBlock. Malicious users can amplify their input. For example, if a malicious user inputs 10K of content,...

CVE-2025-32423

AutoGPT contains a DoS vulnerability in the ExtractTextInformationBlock prior to version 0.6.32. Malicious input amplification can cause a server to consume excessive memory (e.g., 10 KB input leading to ~50 GB memory usage), exhausting resources and causing DoS. The issue is fixed in 0.6.32. Aff...

PT-2026-52846

Name of the Vulnerable Software and Affected Versions AutoGPT versions prior to 0.6.32 Description AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. A Denial of Service DoS issue exists in the ExtractTextInformationBlock...