11 matches found
CVE-2026-105050
PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string" is mishandled...
CVE-2026-105050: Incorrect Behavior Order: Validate Before Canonicalize
PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation character already used in the string" is mishandled...
UBUNTU-CVE-2026-84838
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...
PT-2026-84802
Name of the Vulnerable Software and Affected Versions rpmuncompress affected versions not specified Description A command injection flaw exists in rpmuncompress that allows a local attacker to execute arbitrary commands. The issue occurs when the tool processes a specially crafted archive filenam...
CVE-2026-71284 Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename
Fledge's backup-restore upload handler, uploadbackup python/fledge/services/core/api/backuprestore.py, takes the first extracted tar member's filename tarfilenames0 and builds a shell command via string formatting. Because os.system invokes a shell and no quoting shlex.quote, list-form subprocess...
Linux Malware Delivered via Malicious RAR Filenames Evades Antivirus Detection
Cybersecurity researchers have shed light on a novel attack chain that employs phishing emails to deliver an open-source backdoor called VShell. The "Linux-specific malware infection chain that starts with a spam email with a malicious RAR archive file," Trellix researcher Sagar Bade said in a...
CVE-2017-11190
unrarlib.c in unrar-free 0.0.1, when DEBUGLOG mode is enabled, might allow remote attackers to cause a denial of service stack-based buffer overflow and application crash or possibly have unspecified other impact via an RAR archive containing a long filename...
Design/Logic Flaw
cbrPager before 0.9.17 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a 1 ZIP aka .cbz or 2 RAR aka .cbr archive filename...
CVE-2008-2575
CVE-2008-2575 affects the cbrPager utility. The vulnerability allows user-assisted remote code execution via shell metacharacters in archive filenames for image archives (ZIP/.cbz and RAR/.cbr). Affected version: cbrPager before 0.9.17. The issue arises from filenames being passed to decompressio...
CVE-2008-2575: Improper Neutralization of Special Elements used in an OS Command
cbrPager before 0.9.17 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a 1 ZIP aka .cbz or 2 RAR aka .cbr archive filename...
