MALW

CVE-2007-4559 - Polemarch exploit Full working exploit for Polemarch server https://www.polemarch.org/, using CVE-2007-4559, allowing: Injection of a cryptominer for monero using TOR for better hiding. Injection of a rootkit targeting most common sysadmin tools. POC Proof of concept using...

CVE-2025-4517-POC-Sudoers

CVE-2025-4517 - POC adding user to sudoers This script is a weaponized version of the research published in the Google Security Research Advisory: https://github.com/google/security-research/security/advisories/GHSA-hgqp-3mmf-7h8f While the original research demonstrates the vulnerability by...

CVE-2025-4138-POC

CVE-2025-4138 - Python tarfile PATHMAX Bypass PoC Author: d3vn0mi / \ \ / / | | / \ | | | | || | / | | \ V /| | | | | | | \ | | || || / \ | | | | | ||/ /| || / / || | , | | || || ||/|/ |||/ // CVE-2025-4138 :: Python tarfile PATHMAX Bypass Author: d3vn0mi Overview A proof-of-concept exploit...

CVE-2025-4517-Python-tarfile-filter-data-Bypass-PoC

CVE-2025-4517 — Python tarfile filter="data" Bypass PoC Path traversal vulnerability in Python's tarfile module affecting versions 3.8.0 through 3.13.1. The filter="data" sandbox — intended to prevent unsafe extractions — can be bypassed by crafting paths that exceed PATHMAX 4096 bytes, causing...

CVE-2025-4138-poc

CVE-2025-4138 Auto-Sudo Generator A Python script to generate a malicious tar archive that exploits CVE-2025-4138 / CVE-2025-4517 Path Traversal via PATHMAX Truncation. Successfully exploiting this vulnerability allows an attacker to bypass tarfile extraction filters and write arbitrary files to...

CVE-2007-4559-lab

CVE-2007-4559 — TarSlip: The 15-Year Directory Traversal Educational use only. This lab intentionally exploits file system vulnerabilities inside isolated Docker containers. Do not run on any system with sensitive data or in production environments. A self-contained Docker lab that demonstrates...

Creosote

Creosote Creosote is our solution to searching for the tarfile vulnerability described by CVE-2007-4559. The tool recursively traverses the given directory searching for python files. When the tool finds python files it scans them for the tarfile module and then parses the code into an AST to loo...

CVE-2007-4559

PoC or Exploit for CVE-2007-4559 A malicious TAR archive can include file paths like ../../../../etc/passwd, which try to "climb up" out of the intended extraction folder. If a Python script uses tarfile.extract or extractall without checking the file paths, it will unpack files to those location...

CVE-2025-4517-tarfile-PATH_MAX-bypass

CVE-2025-4517 / CVE-2025-4330 — Python tarfile Data Filter Bypass via PATHMAX Overflow Author: 0xDTC CVEs: CVE-2025-4517 / CVE-2025-4330 Advisory: GHSA-6r6c-684h-9j7p CPython Fix: PR 135037 Overview Python's tarfile.extractallfilter="data" is supposed to safely extract tar archives by preventing...

CVE-2025-4138_tarfile_filter_bypass

CVE-2025-4138 — Python tarfile filter="data" Bypass Arbitrary file write outside the extraction directory via PATHMAX symlink chain. Affected Versions Python 3.12.0 – 3.12.10 Python 3.13.0 – 3.13.3 Fixed in 3.12.11 / 3.13.4 Credit: Reporter: Caleb Brown Google How It Works Python's tarfile data...

CVE-2025-4517-PoC

CVE-2025-4517-PoC CVE-2025-4517 is a vulnerability in Python’s tarfile module that allows arbitrary file writes outside the extraction directory when extracting untrusted tar archives. The issue occurs when using TarFile.extract or TarFile.extractall with filter="data" or filter="tar", which does...

CVE-2025-4138

CVE-2025-4138 Python Tarfile module Directory Traversal Vulnerability With overflow crossed Directory Impact : Privilege escalation Working : Python's TarFile.extractall and TarFile.extract methods support a feature that allows a filter to be set to improve the safety of using these methods...

CVE-2025-4517-POC

CVE-2025-4517 Exploit NOTES This exploit and description are written by AI. If you find a mistake or issue, please let me know! This exploit was tested and confirmed working. Thank you! Overview This exploit leverages CVE-2025-4517 , a critical vulnerability in Python's tarfile module that allows...

CVE-2025-4138-4517-POC

CVE-2025-4138 / CVE-2025-4517 Python tarfile Filter Bypass via PATHMAX Symlink Escape Arbitrary file write throughfilter="data" / filter="tar" extraction Table of Contents Overview Vulnerability Details How It Works Affected Versio...

CVE-2025-4517-poc

CVE-2025-4517 PoC – Python tarfile Arbitrary File Write via Path Traversal CVE-2025-4517 CVSS 9.4 – Critical A vulnerability in Python's tarfile module that allows arbitrary file writes outside the extraction directory when using TarFile.extractall or TarFile.extract with filter="data" or...

DEBIAN-CVE-2026-114583

tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall with filter="tar" to write files...

CVE-2026-114583

tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall with filter="tar" to write files...

CVE-2026-114583

tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall with filter="tar" to write files...

EUVD-2026-108512

tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall with filter="tar" to write files...

CVE-2026-114583 tar filter allows writing outside destination via empty-named symlink

tarfile.tarfilter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall with filter="tar" to write files...