34 matches found
CLEANSTART-2026-GV65273 tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory
Security vulnerability affects the openbao package. The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory...
CVE-2026-101304: Improper Check for Dropped Privileges
When fdescfs4 was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FDRESOLVEBENEATH or the Capsicum capability rights of descriptor N. A process in a jail that has received a directory file descriptor from another jail can use these technique...
AZL-98403 CVE-2026-82455 affecting package ruby 3.3.5-9
RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...
GHSA-3VRX-526R-64RM Duplicate Advisory: GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hmq2-w58f-27jc. This link is maintained to preserve external references. Original Description GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git...
PYSEC-2026-3784
GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython...
PYSEC-2026-3784
GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython...
CVE-2026-76222
GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython...
CVE-2026-75830
grav-plugin-api getgrav/grav-plugin-api versions = 1.0.0-beta.10 and = 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter via POST /api/v1/pages/batch unvalidated. An...
CVE-2026-48099
WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4...
CVE-2026-48099 WsgiDAV encoded dot segments can escape filesystem share roots
WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4...
CVE-2026-48099 WsgiDAV encoded dot segments can escape filesystem share roots
WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4...
CVE-2026-48099
WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4...
CVE-2026-48099: Improper Limitation of a Pathname to a Restricted Directory
WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4...
CVE-2026-41211: Improper Limitation of a Pathname to a Restricted Directory
Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, downloadPackageManager accepts an untrusted version string and uses it directly in filesystem paths. A caller can supply ../ segments or an absolute path to escape the VPHOME/packagemanager/ / cache root an...
CVE-2025-15547
By default, jailed processes cannot mount filesystems, including nullfs4. However, the allow.mount.nullfs option enables mounting nullfs filesystems, subject to privilege checks. If a privileged user within a jail is able to nullfs-mount directories, a limitation of the kernel's path lookup logic...
CVE-2026-27139: Undefined Security Weakness
On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the...
OESA-2026-1008 crun security update
crun is a fast and low-memory footprint OCI Container Runtime fully written in C. Security Fixes: crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could trick the krun handler into escaping the root filesystem, allowing file creatio...
EUVD-2023-34310
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2025-24965
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could trick the krun handler into escaping the...