CVE-2026-71283

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, calls tarfile.extractalltemppath on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role @haspermission"admin"...

CVE-2026-71283 Fledge IoT Gateway Backup Restore Tar Path Traversal

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, calls tarfile.extractalltemppath on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role @haspermission"admin"...

CVE-2026-71283 Fledge IoT Gateway Backup Restore Tar Path Traversal

Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, calls tarfile.extractalltemppath on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role @haspermission"admin"...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: tar: tar-1.35-9.2.hum1 aarch64, x8664 tar-1.35-9.2.hum1.src src...

tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary...

MAL-2026-12460 Malicious code in streak-count-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d391f9ec30841fdf31ec1afeeb309a1e8895c445c811a1a1f7f3e0a754c5e4fa [email protected]'s index.mjs executes a hex-obfuscated routine on module import gated only by NODEENV!== 'production'. When it detects a WSL...

PT-2026-68262

Name of the Vulnerable Software and Affected Versions Jenkins versions prior to 2.576 Jenkins LTS versions prior to 2.568.2 Description Jenkins fails to safely handle symbolic links with effectively empty names when extracting .tar and .tar.gz archives. This allows attackers who control agent...

Link following vulnerability allows arbitrary file creation

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives. This allows attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

MiracleLinux 8 : nodejs:24 (AXSA:2026-1455:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1455:01 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed...

MiracleLinux 8 : nodejs:22 (AXSA:2026-1464:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1464:01 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed...

CLSA-2026-1783904631 TuxCare security update for tar (3 CVEs)

TuxCare rebuilt tar to address 3 CVEs. Fixed in 6.1.15-tuxcare.1...

CLSA-2026-1777941831 TuxCare security update for tar (12 CVEs)

TuxCare rebuilt tar to address 12 CVEs. Fixed in 2.2.1-tuxcare.1...

CLSA-2026-1776818213 TuxCare security update for tar (2 CVEs)

TuxCare rebuilt tar to address 2 CVEs. Fixed in 1.0.3-tuxcare.3...

CLSA-2026-1776731786 TuxCare security update for tar (1 CVE)

TuxCare rebuilt tar to address 1 CVE. Fixed in 2.1.1-tuxcare.3...

CLSA-2026-1775176089 TuxCare security update for tar (2 CVEs)

TuxCare rebuilt tar to address 2 CVEs. Fixed in 6.0.2-tuxcare.1...

CLSA-2026-1774830255 TuxCare security update for tar (7 CVEs)

TuxCare rebuilt tar to address 7 CVEs. Fixed in 2.1.1-tuxcare.2...

CLSA-2026-1774484497 TuxCare security update for tar-fs (11 CVEs)

TuxCare rebuilt tar-fs to address 11 CVEs. Fixed in 1.5.1-tuxcare.1...

CLSA-2026-1773706632 TuxCare security update for tar (5 CVEs)

TuxCare rebuilt tar to address 5 CVEs. Fixed in 1.0.3-tuxcare.2...

CLSA-2026-1773533794 TuxCare security update for tar (2 CVEs)

TuxCare rebuilt tar to address 2 CVEs. Fixed in 6.2.1-tuxcare.1...

RLSA-2026:49525 Important: perl-Archive-Tar security update

Archive::Tar provides an object oriented mechanism for handling tar files. It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation. If you have the IO::Zlib module installed, Archive::Tar will also support...