CVE-2007-4559

demostración de CVE-2007-4559 ¿qué es esto? Esta es una demostración de cómo el manejo predeterminado de Python para la extracción de archivos tar anterior a Python v3.11.4 es vulnerable a un simple ataque de symlink. Las instrucciones a continuación describen cómo crear un payload malicioso. El...

NodeJS-Tar-Symlink-Exploit-CVE-2026-29786

📦 CVE-2026-29786: Node.js Tar Symlink Vulnerability -yellow 📌 Executive Summary This repository documents research into CVE-2026-29786 , a high-severity vulnerability discovered in the popular Node.js tar package. The flaw allows an attacker to create a malicious tar archive that, when extracted,...

CVE-2026-31802

🛡️ CVE-2026-31802 - Visor Simple de Prueba de Concepto 📋 Acerca de CVE-2026-31802 Este repositorio proporciona una prueba de concepto PoC y un informe detallado para CVE-2026-31802. El problema es una vulnerabilidad de seguridad en el paquete npm tar. Permite a los atacantes engañar al software...

wargame-tarpioka

BubbleTea CVE-2007-4559 Vulnerabilidad de path traversal mediante “.tar” que permite acceder a ../../flag ruta root@kitploit: BubbleTea/ ├── Dockerfile ├── flag ├── requirements.txt └── src ├── files ├── template │ └── index.html └── app.py Instrucciones de compilación actuales verificar docker...

CVE-2026-23745

CVE-2026-23745: node-tar Arbitrary File Overwrite Research: Joshua van Rijswijk Description PoC for CVE-2026-23745 , a high-severity path traversal vulnerability in node-tar 7.5.2. The library fails to sanitize absolute paths in the linkpath field for Hardlinks and Symlinks. This allows malicious...

cve-tarmageddon

CVE-2025-62518: TAR末日 本仓库演示了 tokio-tar 及相关异步 Rust tar 库中的一个严重错误：在计算下一个文件头位置之前，未应用 PAX 扩展头中的 size 覆盖值。 错误摘要 根本原因： 处理包含 PAX 扩展头（且扩展头覆盖了文件大小）的 tar 文件时，库使用八进制的大小字段（通常为零）进行位置计算，而非 PAX 覆盖值。 影响： 这会导致解析器跳入文件内容，并将其误认为 tar 文件头，从而提取错误的文件。 已知受影响的库： async-tar https://github.com/dignifiedquire/async-tar...

CVE-2007-4559

CVE-2007-4559 的 PoC 或漏洞利用 恶意 TAR 压缩包可以包含像 ../../../../etc/passwd 这样的文件路径，试图“爬升”出预期的解压文件夹。 如果 Python 脚本使用了 tarfile.extract 或 extractall 而没有检查文件路径，它就会将文件解压到这些位置——即使它们指向目标目录之外。 这意味着黑客可以覆盖敏感或系统文件，尤其是当用户以提升的权限运行脚本时。 受影响系统 截至 2025 年，Debian 11–12 和 Ubuntu 24...

CVE-2019-1002101-Helpers

kubectlcpCVE-2019-1002101 Scripts auxiliares de PoC y Dockerfile para CVE-2019-1002101 Para información detallada, visite https://www.twistlock.com/labs-blog/disclosing-directory-traversal-vulnerability-kubernetes-copy-cve-2019-1002101/ y...

wildpwn

首先！ 阅读：https://www.exploit-db.com/papers/33930/ 基本用法 大致如下： root@kitploit: usage: wildpwn.py -h --file FILE payload folder 用于生成Unix通配符攻击的工具 位置参数： payload 要使用的payload：combined | tar | rsync folder 写入payload的目录 可选参数： -h, --help 显示此帮助信息并退出 --file FILE 要获取所有权/修改权限的文件路径。仅与combined攻击一起使用。 Payload类型...

cve-2025-32434-poc

CVE-2025-32434 描述 技术细节 漏洞入口点是 torch/serialization.py 中的 load 函数 当保护（weightsonly）启用时： 加载 tar 文件会依次调用以下函数： 1. load: torch/serialization.py:1117 2. loadlegacy: torch/serialization.py:1376 至 torch/serialization.py:1406 3. persistentload: torch/serialization.py:1474 4. picklemodule.load:...

CVE-2021-32804

CVE-2021-32804 yamory blog 「CVE-2021-32804 npmにも影響があるnode-tarのパストラバーサルの脆弱性」 で利用したDocker環境の構築を行うためのレポジトリです。 环境搭建 root@kitploit: docker build -t cve-2021-32804 . docker run -it cve-2021-32804 /bin/bash 重现漏洞 node-tar root@kitploit: root@5e1af2148215:/poc node tar.js root@5e1af2148215:/poc su node...

CVE-2024-0406-POC

CVE-2024-0406 Prueba de concepto PoC Este repositorio contiene un exploit de prueba de concepto PoC para CVE-2024-0406 , una vulnerabilidad relacionada con la extracción de archivos tar basada en enlaces simbólicos que permite el recorrido de rutas path traversal o la sobrescritura de archivos en...

CVE-2024-42471-PoC

CVE-2024-42471-PoC vulnerabilidad de escritura/sobrescritura de archivos en tar-fs...

EUVD-2025-210915

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...

CVE-2025-11395

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...

CVE-2025-11395

Podman is affected by an arbitrary file write vulnerability that occurs when importing an OCI archive via the podman load command. An attacker who can supply a crafted tar archive to this command can create files on the host with the privileges of the user running Podman. The flaw is scored CVSS ...

CVE-2025-11395 Podman: arbitrary file write when importing oci archive

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...

npm-tar-path-traversal-scanner

CVE-2026-31802 — Escáner de Path Traversal en npm tar Detecta paquetes npm vulnerables a CVE-2026-31802 , una vulnerabilidad de path traversal en el paquete npm tar que permite la escritura arbitraria de archivos durante la extracción de archivos. Características Escanea package-lock.json en busc...

CVE-2026-79699

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...

CVE-2026-79705

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not...