CVE-2025-0851

CVE-2025-0851 This vulnerability occurs in the Deep Java Library an open-source framework for Java deep learning when providing utilities for extracting tar and zip model archives used for loading models. A File Traversal vulnerability arises in the untar and unzip functions. Details: When creati...

GHSA-9HQ4-HM3J-JMPH DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885

Summary The CVE-2026-32885 ZipSlip fix added a symlink-target escape check to Untar, but the check rebases an ABSOLUTE symlink target into dest before validating filepath.Joindest, "/etc" stays lexically inside dest and passes, while the symlink is then created with the RAW absolute target via...

DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885

Summary The CVE-2026-32885 ZipSlip fix added a symlink-target escape check to Untar, but the check rebases an ABSOLUTE symlink target into dest before validating filepath.Joindest, "/etc" stays lexically inside dest and passes, while the symlink is then created with the RAW absolute target via...

CVE-2026-123815

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar.safeextractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before calling...

CVE-2026-123815

The open-source download manager pyLoad is vulnerable in versions prior to 0.5.0b3.dev102 due to a flaw in the UnTar._safe_extractall function within src/pyload/plugins/extractors/UnTar.py. While the system validates member names and symlink targets, it fails to check member types (e.g., using Ta...

CVE-2026-123815 pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar.safeextractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before calling...

CVE-2026-123815 pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar.safeextractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before calling...

EUVD-2026-120451

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar.safeextractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before calling...

CVE-2026-123815

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar.safeextractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before calling...

CVE-2026-123815: pyload: pyLoad is a free and open-source download manager written in Python

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, UnTar.safeextractall in src/pyload/plugins/extractors/UnTar.py validates archive member paths and link targets but does not call TarInfo.isdev to reject special tar member types before calling...

CVE-2026-108262 DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885

DDEV is an open-source tool for running local web development environments for PHP and Node.js. From 1.25.2 until 1.25.4, Untar in pkg/archive/archive.go validates an absolute tar symlink target after rebasing it beneath dest, but creates the symlink with the raw absolute Linkname. A crafted...

CVE-2026-109155

A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not...

CVE-2026-109155

A path traversal vulnerability exists in DeepPavlov versions up to 1.7.0 . The flaw resides in the untar function within the Model Download Handler component. This vulnerability allows for remote execution of a path traversal attack. While the issue was reported via a project issue report, the pr...

CVE-2026-109155 DeepPavlov Model Download untar path traversal

A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not...

CVE-2026-109155 DeepPavlov Model Download untar path traversal

A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not...

CVE-2026-109155

A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not...

EUVD-2026-98451

A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not...

CVE-2026-109155 DeepPavlov Model Download untar path traversal

A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not...

PT-2026-111406

A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not...

CVE-2026-109155: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not...