Se7enSlip

🔒 Se7enSlip - 7-Zip-Schwachstellenscanner Eine beeindruckende, interaktive Webanwendung, die die kritische CVE-2023-52169 Symlink-Traversal-Schwachstelle in 7-Zip-Archiven demonstriert und bei deren Erkennung hilft. ⚡ Funktionen 🎯 Kernfunktionalität ZIP-Upload & Analyse - Drag & Drop oder Klicken...

ZipRarHunter

ZipRarHunter ZipRarHunter è un potente strumento di hacking etico da riga di comando progettato per crackare le password di file di archivio ZIP e RAR utilizzando una wordlist. Automatizza il processo di recupero delle password da archivi crittografati. Caratteristiche Crack di file ZIP...

CVE-2024-55587

CVE-2024-55587 Dieses Repository ist ein Proof of Concept für die Sicherheitslücke CVE-2024-55587 in der Python-Bibliothek libarchive. Die Datei generatezip erstellt eine bösartige Zip-Datei, die die unsichere Extraktion von Dateien in der extractall-Methode von libarchive ausnutzt. Die Datei...

ZipCracker

ZipCracker ZipCracker è un'utility semplice ma potente per la forza bruta delle password, progettata per decifrare archivi ZIP protetti da password. È costruito con Qt e integra un motore di cracking personalizzato, offrendo supporto sia CLI che GUI. ⚡ Disclaimer: Questo strumento è destinato...

zombieguard

ZombieGuard Uno scanner difensivo per l'evasione dei metadati strutturali negli archivi ZIP. ZombieGuard rileva contraddizioni tra le intestazioni locali dei file ZIP, i record della directory centrale e le caratteristiche del payload. Queste contraddizioni possono essere usate per far apparire i...

CVE-2026-17014

The CVE-2026-17014 entry affects the WP Photo Album Plus WordPress plugin prior to 9.2.07.002. The public REST endpoint action lacks capability or nonce checks, allowing unauthenticated users to delete generated album export ZIP archives stored by the plugin. This is the root cause and directly e...

SUSE CVE-2026-47078

Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integer...

CVE-2026-28900

A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks...

PYSEC-2026-2875 pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds wit...

PYSEC-2026-2856 OpenViking contains a Path Traversal vulnerability

OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to write files outside the intended import directory. Attackers can craft malicious ZIP archives with traversal sequences, absolute paths, or...

PT-2026-59494

OpenViking versions 0.2.1 and prior, fixed in commit 46b3e76, contain a path traversal vulnerability in the .ovpack import handling that allows attackers to write files outside the intended import directory. Attackers can craft malicious ZIP archives with traversal sequences, absolute paths, or...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the Include.parse process. An attacker can access arbitrary files outside the intended markdown directory by supplying crafted include paths when markdown files are processed using md.read. Details A Directory...

CVE-2026-14966

BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted...

CVE-2026-14966 Symlink guard bypass in unarchive module allows planting symlinks during extraction

BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted...

EUVD-2026-42295

BBOT's unarchive module rejects archives containing symlink entries before extraction, but for zip and 7z archives it failed to detect symlinks whose listing carries a DOS-attribute prefix before the unix mode, as produced by legacy versions of p7zip. Such an archive, downloaded and extracted...

vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass

A flaw was found in Vim's zip.vim plugin. A local user could be tricked into opening a specially crafted zip archive, which would allow a path traversal bypass. This vulnerability enables an attacker to overwrite arbitrary files on the system, potentially leading to data integrity issues or furth...

CVE-2026-56876

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory...

EUVD-2026-39812

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory...

CVE-2026-56876

extract-zip does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip will extract the symlink without validation, allowing it to point outside the extraction directory...

Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access

In this article 1. Attack chain overview 2. Mitigation and protection guidance 3. References 4. Learn more Microsoft Threat Intelligence has identified an active multi-stage intrusion campaign targeting organizations in the hospitality and hotel industry since April 2026. We’ve observed this...