gitpython: GitPython: Arbitrary File Overwrite via `git read-tree` option injection

A flaw was found in GitPython. This vulnerability allows an attacker to overwrite arbitrary files on the system. By injecting specific options into the git read-tree command through methods like IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree, without proper option validation or...

gitpython: GitPython: Arbitrary file overwrite and read via unsafe git option forwarding

A flaw was found in GitPython. This vulnerability arises from insufficient guarding of git option forwarding within the IndexFile.checkout and TagReference.create functions. An authenticated attacker can exploit this by passing unsafe options through keyword arguments, leading to the ability to...

Directory Traversal

Overview rubyzip is a ruby module for reading and writing zip files. Affected versions of this package are vulnerable to Directory Traversal via Zip::Entryextract in lib/zip/entry.rb. An attacker can write files outside the intended extraction directory by supplying a crafted archive entry path...

CVE-2026-75602

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

EUVD-2026-70550

OpenList a file list program that supports multiple storage. Prior to 4.2.3, OpenList's offline-download feature at POST /api/fs/addofflinedownload with tool: "SimpleHttp" accepts an attacker-supplied URL and saves its bytes under a per-task temporary directory before transferring them to the...

CVE-2026-85092

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

EUVD-2026-70302

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-85092

LiME (Linux Memory Engine) through version 1.12.0 contains an arbitrary file overwrite vulnerability caused by a missing O_NOFOLLOW flag and insufficient validation of the operator-supplied disk acquisition output path. An unprivileged local attacker who controls the output directory can plant a ...

CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

SUSE CVE-2026-81727

NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incrdownload methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader...

PT-2026-84906

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O NOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-85092: Improper Link Resolution Before File Access

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

PT-2026-85135

Name of the Vulnerable Software and Affected Versions OpenList versions prior to 4.2.3 Description The offline-download feature at the 'POST /api/fs/add offline download' endpoint is susceptible to path traversal when using the tool: "SimpleHttp" configuration. The application accepts a...

EUVD-2026-68883

pnpm: A tarball dependency's manifest name escapes nodemodules → arbitrary file write/overwrite on install...

NLTK: Downloader.download follows hardlinks and overwrites outside-root files

Summary NLTK's downloader now blocks symlink escapes during ZIP extraction, but it still treats pre-existing hardlinks inside the install tree as ordinary in-root files. A normal package install can therefore overwrite an outside-root inode through that hardlink. Details - Vulnerability type:...

EUVD-2026-67077

NLTK: Downloader.download follows hardlinks and overwrites outside-root files...

External Control of File Name or Path

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to External Control of File Name or Path via the Downloader.download and Downloader.incrdownload file-write path in nltk/downloader.py. An attacke...

GHSA-F794-5JV7-7672 NLTK: Downloader.download follows hardlinks and overwrites outside-root files

Summary NLTK's downloader now blocks symlink escapes during ZIP extraction, but it still treats pre-existing hardlinks inside the install tree as ordinary in-root files. A normal package install can therefore overwrite an outside-root inode through that hardlink. Details - Vulnerability type:...