CVE-2024-12905-PoC

CVE-2024-12905 tar-fs file write/overwrite vulnerability...

EUVD-2026-87731

SiYuan versions before v3.8.4 contain a path traversal vulnerability in the checkoutRepo endpoint that allows authenticated administrators to write JSON files outside the workspace. Attackers can supply a sessionID parameter containing directory traversal sequences to overwrite arbitrary JSON fil...

Astra Linux – Vulnerability in docker.io-app

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not limit filesystem operations to the destination directory. The extractor determines the location of each archive entry using lexical string checks, and then performs the...

BadPfs-CVE-2022-4510

BadPfs Script de Python que genera payloads pfs para explotar CVE-2022-4510 Simplemente crea un payload pfs usando el script. Cuando se ejecuta binwalk con -e sobre el payload, se puede sobrescribir un archivo con los permisos de binwalk. Este ejemplo sobrescribirá /etc/sudoers con el contenido d...

CVE-2024-12252

SEO LAT Auto Post = 2.2.1 - Remote Code Execution Description The SEO LAT Auto Post plugin for WordPress is vulnerable to file overwrite due to a missing capability check on the remoteupdate AJAX action in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated...

CVE-2026-37068

CVE-2026-37068 Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected...

CVE-2026-100372 ClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.php

ClipBucket v5 before 5.5.3-197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrators to overwrite PHP files by supplying directory traversal sequences in the folder parameter. Attackers with managetemplateaccess permission can traverse outsi...

CVE-2026-65891

CVE-2026-65891 — Joomla JCE Rename PoC Proof-of-concept scanner for CVE-2026-65891 in the Joomla Content Editor JCE extension. Improper input validation in the JCE file manager rename function allows an authenticated user with file-management permissions to: create hidden files dot-prefixed names...

CVE-2022-43293

Exploits for CVE-2022-43293 To get a persistent Windows Denial of Service as shown in the POC above, simply run Exploit.bat and enter %windir%\system32\cng.sys when you're asked which file you want to overwrite. Here you can find my Arbitrary File Write\Overwrite Vulnerability report. Here you ca...

CVE-2026-59682

A flaw was found in OpenRGB. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted SAVEPROFILE network message to the application. Successful exploitation allows the attacker to overwrite or delete arbitrary files on the target system, leading to...

CVE-2026-78394

The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including...

CVE-2026-78394 Link Library < 7.9.6 - Contributor+ Path Traversal via 'filepath' Parameter

The Link Library WordPress plugin before 7.9.6 does not sanitize a user-supplied destination folder before writing a generated image to disk, allowing users with the Contributor role and above to create directories and write or overwrite image files anywhere the web server can write, including...

PT-2026-98359

Name of the Vulnerable Software and Affected Versions Link Library versions prior to 7.9.6 Description Insufficient sanitization of a user-supplied destination folder occurs when writing a generated image to disk. This allows users with the Contributor role and above to create directories and wri...

RLSA-2026:70390 Moderate: tar security, bug fix, and enhancement update

The GNU tar program can save multiple files in an archive and restore files from an archive. Security Fixes: tar: Tar path traversal CVE-2025-45582 tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path...

tar security, bug fix, and enhancement update

An update is available for tar. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The GNU tar program can save multiple files in an archive and restore files from ...

RockyLinux 8 : tar (RLSA-2026:70390)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:70390 advisory. tar: Tar path traversal CVE-2025-45582 tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X'...

AlmaLinux 8 : tar (ALSA-2026:70390)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:70390 advisory. tar: Tar path traversal CVE-2025-45582 tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X'...

tar: Tar path traversal

A flaw was found in GNU Tar. An attacker could exploit this vulnerability by providing two specially crafted TAR archives, if those archives were extracted in the same directory. The first archive contains a symbolic link that points to a critical directory. The second archive, when extracted, us...

tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary...

Moderate: Red Hat Security Advisory: tar security, bug fix, and enhancement update

An update for tar is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...