CVE-2025-4517-PoC

CVE-2025-4517-PoC CVE-2025-4517 is a vulnerability in Python’s tarfile module that allows arbitrary file writes outside the extraction directory when extracting untrusted tar archives. The issue occurs when using TarFile.extract or TarFile.extractall with filter="data" or filter="tar", which does...

Tarmageddon-CVE-2025-62518-

Tarmageddon CVE-2025-62518 Video: https://youtu.be/EYBB4BHsp9E Repo directories vulnerable-extract minimal repoducible example, takes a path as arg, and extracts that file to ./output malicious-payload creates a simple malicious.tar archive with some example of smuggled content, comments explain...

NodeJS-Tar-Symlink-Exploit-CVE-2026-29786

📦 CVE-2026-29786: Node.js Tar Symlink Vulnerability -yellow 📌 Executive Summary This repository documents research into CVE-2026-29786 , a high-severity vulnerability discovered in the popular Node.js tar package. The flaw allows an attacker to create a malicious tar archive that, when extracted,...

RLSA-2026:98076 Important: sos security, bug fix, and enhancement update

The sos package contains a set of utilities that gather information from system hardware, logs, and configuration files. The information can then be used for diagnostic purposes and debugging. Security Fixes: sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink...

sos security, bug fix, and enhancement update

An update is available for sos. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The sos package contains a set of utilities that gather information from system...

CopyEscape-CVE-2026-17106

CopyEscape: Taking Over Docker Hosts with docker cp CVE-2026-17106 This is the proof-of-concept repository for the blog post CopyEscape: Taking Over Docker Hosts withdocker cp — CVE-2026-17106. CopyEscape allows a malicious running container to race Docker's archive producer and create an...

RLSA-2026:97867 Important: sos security, bug fix, and enhancement update

The sos package contains a set of utilities that gather information from system hardware, logs, and configuration files. The information can then be used for diagnostic purposes and debugging. Security Fixes: sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink...

sos security, bug fix, and enhancement update

An update is available for sos. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The sos package contains a set of utilities that gather information from system...

CVE-2026-64824-PoC

CVE-2026-64824 — Home Assistant Core Backup-Restore Symlink Path Traversal → RCE CVSS 8.4 Critical · GHSA-cwh8-w64c-4j5h · CWE-22 / CWE-59 TL;DR Authenticated admin attacker uploads a crafted backup tar. The restore path extracts the inner homeassistant.tar.gz with filter="fullytrusted" and only...

npm-tar-path-traversal-scanner

CVE-2026-31802 — npm tar Path Traversal Scanner Detects npm packages vulnerable to CVE-2026-31802 , a path traversal vulnerability in the tar npm package that allows arbitrary file writes during archive extraction. Features Scans package-lock.json for vulnerable tar versions Checks nodemodules fo...

POC-CopyEscape-CVE-2026-17106

CopyEscape — PoC for CVE-2026-17106 Educational Proof of Concept of CopyEscape CVE-2026-17106, a TOCTOU race condition vulnerability in docker cp that allows a malicious container to write arbitrary files on the Docker host. Inspired by the original work of masasron , who discovered and documente...

github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction

A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or...

Important: Red Hat Security Advisory: sos security, bug fix, and enhancement update

An update for sos is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

RHEL 10 : sos (RHSA-2026:98076)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:98076 advisory. The sos package contains a set of utilities that gather information from system hardware, logs, and configuration files. The information can then b...

Important: Red Hat Security Advisory: sos security, bug fix, and enhancement update

An update for sos is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

CLEANSTART-2026-OU13146 tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory

Security vulnerability affects the openbao package. The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory...

Linux Distros Unpatched Vulnerability : CVE-2025-71437

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution sdist tar extraction that allows a specially crafted sequence of symlinks...

Important: docker

Issue Overview: The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination. CVE-2026-171...