9 matches found
CVE-2026-3087
CVE-2026-3087 describes a vulnerability in Python’s shutil.unpack_archive() where extracting a ZIP that contains an absolute Windows path (for example starting with C:) can cause files to be written outside the target directory. The issue is Windows-specific; other operating systems are not affec...
AnythingLLM 代码注入漏洞
AnythingLLM is an all-in-one AI application open-sourced by Mintplex. AnythingLLM has a code injection vulnerability that stems from the ImportedPlugin.importCommunityItemFromUrl function downloads a ZIP file and extracts it without verifying the path to the file within the archive, which can be...
EUVD-2025-28706
Malicious code in bioql PyPI...
PT-2024-31605 · Stripe · Stripe Cli
Name of the Vulnerable Software and Affected Versions: stripe-cli versions 1.11.1 through 1.21.2 Description: A path traversal vulnerability exists in stripe-cli where a plugin package containing a manifest with a malformed plugin shortname installed using the --archive-url or --archive-path flag...
PT-2023-30766
Name of the Vulnerable Software and Affected Versions TorchServe versions 0.1.0 through 0.9.0 Description The issue allows uploading potentially harmful archives that contain files extracted to any location on the filesystem within the process permissions, using the model/workflow management API...
MLeap Path Traversal Vulnerability
MLeap is a common serialization format and execution engine for machine learning pipelines. MLeap suffers from a security vulnerability that stems from not verifying that file paths in an archive are located outside of the expected directory, and arbitrary file creation can lead directly to code...
php: use after free in phar_object.c
A use-after-free flaw was found in PHP's phar PHP Archive paths implementation. A malicious script author could possibly use this flaw to disclose certain portions of server memory...
php: use after free in phar_object.c
A use-after-free flaw was found in PHP's phar PHP Archive paths implementation. A malicious script author could possibly use this flaw to disclose certain portions of server memory...
