neto

Project Neto: A Toolkit for Analysing Browser Plugins Overview Project Neto is a Python 3 package conceived to analyse and unravel hidden features of browser plugins and extensions for well-known browsers such as Firefox and Chrome. It automates the process of unzipping the packaged files to...

CVE-2025-0851

CVE-2025-0851 本脆弱性は、Deep Java LibraryJavaディープラーニングのオープンソースフレームワークでモデルをロードする際に使用されるtarおよびzipモデルアーカイブを抽出するためのユーティリティを提供する中で、untarおよびunzip機能にFile Traversal脆弱性が発生したことによるものです。 詳細 : Linuxシステムでアーカイブを作成し、Windowsシステムで抽出する場合、抽出プロセスで関心のある対象意図された対象の外部にアーティファクトが書き込まれる可能性があります。逆の場合も適用可能 テスト方法 :...

cve-2003-0282

これは、Info-ZIPグループのポータブルUnZip zipファイル展開プログラム（および関連ユーティリティ）の2004年5月22日公開版のREADMEファイルです。 unzip551.zip ポータブルUnZip、バージョン5.51、ソースコード配布 unzip551.tar.Z 同上、compressで圧縮されたtar形式 unzip551.tar.gz 同上、gzipで圧縮されたtar形式 質問する前に：...

unzip_poc

unzip 6.0 用のPOC CVE-2022-0529 および CVE-2022-0530 https://bugzilla.redhat.com/showbug.cgi?id=2051402 https://bugzilla.redhat.com/showbug.cgi?id=2051395...

unzip_poc

CVE-2022-0529 と CVE-2022-0530 unzip 6.0 の POC CVE-2022-0529 & CVE-2022-0530 https://bugzilla.redhat.com/showbug.cgi?id=2051402 https://bugzilla.redhat.com/showbug.cgi?id=2051395...

GHSA-2VCX-H8P2-9PG9 Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()

Summary An authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool. The method Installer::unZip calls ZipArchive::extractTo without any limit on uncompressed size, entry count, or directory depth, enabling Zip Bom...

EUVD-2026-42951

Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip...

Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()

Summary An authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool. The method Installer::unZip calls ZipArchive::extractTo without any limit on uncompressed size, entry count, or directory depth, enabling Zip Bom...

CVE-2026-59974 Stanza: Zip Slip Path Traversal in Model/Resource Extraction

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip in stanza/resources/common.py passes downloaded model and resource archives to zipfile.ZipFile.extractall without validating...

Astra Linux – Vulnerability in unzip

A flaw was discovered in unzip. The vulnerability arises from improper handling of Unicode strings, which can lead to a null pointer dereference. This flaw allows an attacker to submit a specially crafted zip file, resulting in a crash or code execution...

Astra Linux – Vulnerability in unzip

A flaw was discovered in Unzip. The vulnerability occurs during the conversion of a wide string to a local string, resulting in an out-of-bound write operation on the heap. This flaw allows an attacker to submit a specially crafted zip file, causing a crash or code execution...

Astra Linux – Vulnerability in unzip

A flaw was discovered in Unzip. The vulnerability occurs during the conversion of a wide string to a local string, resulting in an out-of-bound write operation on the heap. This flaw allows an attacker to submit a specially crafted zip file, causing a crash or code execution...

EUVD-2026-67195

A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10...

ROOT-OS-DEBIAN-12-CVE-2021-4217 CVE-2021-4217 in unzip - Patched by Root

Root has patched CVE-2021-4217 in the unzip package for Root:Debian:12. Multiple fixed versions available...

CVE-2026-57863

Crater Invoice (through 6.0.6 ) contains a path traversal vulnerability in its self-update API. The root cause is unsanitized ZIP entry names containing ../ sequences passed to PHP's ZipArchive::extractTo(), allowing authenticated company owners to write arbitrary files outside the intended extra...

CVE-2026-57863 Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint

Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...

CVE-2026-78638

A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Executing a manipulation of the argument destination can lead to path traversal. The attack can only be executed locally. The...

EUVD-2026-65301

A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Executing a manipulation of the argument destination can lead to path traversal. The attack can only be executed locally. The...

CVE-2026-78638 peerigon unzip-crx/unzip-crx-3 Archive Extraction index.js unzip path traversal

A flaw has been found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0. This affects the function unzip of the file dist/index.js of the component Archive Extraction. Executing a manipulation of the argument destination can lead to path traversal. The attack can only be executed locally. The...

CVE-2026-78638

peerigon unzip-crx and unzip-crx-3 (up to 0.2.0 ) contain a path traversal vulnerability in the unzip function of dist/index.js (Archive Extraction component). Manipulating the destination argument allows writing files outside the intended directory. The attack requires local access with low priv...