CVE-2026-19693 extract-zip arbitrary file write outside the destination directory via a symlink at the final path component

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through t...

CVE-2026-19693

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through t...

BIT-PHP-2026-7260 Stack overflow in phar with circular symlinks

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

BIT-LIBPHP-2026-7260 Stack overflow in phar with circular symlinks

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

PT-2026-73368

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

PT-2026-73422

Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2. before 8.2.33, from 8.3. before 8.3.33, from 8.4. before 8.4.24, and from 8.5. before 8.5.9...

ROS-20260817-73-0018

The vulnerability of the Microsoft .NET software platform and the code editor Visual Studio Code is related to errors in handling symbolic links. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Unity Linux 20.1070a Security Update: libpq (UTSA-2026-099547)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099547 advisory. Symlink following in PostgreSQL pgbasebackup plain format and in pgrewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that...

Unity Linux 20.1070e Security Update: gzip (UTSA-2026-099505)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099505 advisory. GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the users PATH, gzexe...

CVE-2026-19693: Improper Link Resolution Before File Access

extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through t...

PT-2026-76655

Name of the Vulnerable Software and Affected Versions extract-zip versions prior to 2.0.2 Description Containment checks only verify the parent directory of each archive entry and ignore the entry's own final path component. This allows an archive containing two entries with identical names—a...

Unity Linux 20.1070e Security Update: python-filelock (UTSA-2026-099470)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099470 advisory. filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check- Time-of-Use TOCTOU race condition allows local attackers to...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099513)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099513 advisory. Symlink following in PostgreSQL pgbasebackup plain format and in pgrewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099703)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099703 advisory. In the Linux kernel, the following vulnerability has been resolved: isofs: bound Rock Ridge symlink components to the SL record getsymlinkchunk and the SL handling i...

CVE-2026-74796

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...

CVE-2026-74796

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...

CVE-2026-74796 OpenTofu before 1.11.7 Symlink Following Path Traversal

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...

CVE-2026-74796 OpenTofu before 1.11.7 Symlink Following Path Traversal

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...

CVE-2026-74796 OpenTofu before 1.11.7 Symlink Following Path Traversal

OpenTofu before 1.11.7 fails to validate existing symlinks in the provider cache directory during initialization. Attackers can place a malicious symlink in a trusted working directory to cause tofu init to write provider package contents to arbitrary filesystem locations outside the working tree...

CVE-2026-74796

OpenTofu before 1.11.7 is affected by a symlink following path traversal during initialization. The vulnerability arises because OpenTofu fails to validate existing symlinks in the provider cache directory, allowing an attacker to place a malicious symlink in a trusted working directory and cause...