python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination

A flaw was found in the Python tarfile module. This vulnerability allows an attacker to create empty directories outside of the intended extraction destination on POSIX Portable Operating System Interface platforms. This occurs when processing a specially crafted archive containing member names...

Exploit for CVE-2026-74239

CVE-2026-74239 XenForo before 2.3.13 is vulnerable to path tr...

Command Injection

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Command Injection via the restore process. An attacker can execute arbitrary operating system commands as the web application's user by uploading a crafted backup archive an...

ROOT-APP-NPM-CVE-2026-59875 CVE-2026-59875 in tar - Patched by Root

Root has patched CVE-2026-59875 in the tar package for Root:npm. Multiple fixed versions available...

python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination

A flaw was found in the Python tarfile module. This vulnerability allows an attacker to create empty directories outside of the intended extraction destination on POSIX Portable Operating System Interface platforms. This occurs when processing a specially crafted archive containing member names...

python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination

A flaw was found in the Python tarfile module. This vulnerability allows an attacker to create empty directories outside of the intended extraction destination on POSIX Portable Operating System Interface platforms. This occurs when processing a specially crafted archive containing member names...

python: Python tarfile module: Directory traversal allows creation of empty directories outside extraction destination

A flaw was found in the Python tarfile module. This vulnerability allows an attacker to create empty directories outside of the intended extraction destination on POSIX Portable Operating System Interface platforms. This occurs when processing a specially crafted archive containing member names...

CVE-2026-74239

XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal...

CVE-2026-74239 XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows

XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal...

CVE-2026-74239 XenForo < 2.3.13 Path Traversal via Style Archive Importer on Windows

XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal...

EUVD-2026-72759

XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal...

CVE-2026-74239

XenForo before 2.3.13 is affected by a path traversal vulnerability in the style archive importer on Windows deployments. Authenticated non-super administrators with style permissions can exploit backslash-based traversal sequences in ZIP member names to bypass forward-slash validation, writing a...

CVE-2026-19672

A flaw was found in the Python tarfile module. This vulnerability allows an attacker to create empty directories outside of the intended extraction destination on POSIX Portable Operating System Interface platforms. This occurs when processing a specially crafted archive containing member names...

CVE-2026-74859: Improper Limitation of a Pathname to a Restricted Directory

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

CVE-2026-74239: Improper Limitation of a Pathname to a Restricted Directory

XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal...

PT-2026-87067

XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal...

EulerOS 2.0 SP12 : perl-Archive-Tar (EulerOS-SA-2026-3290)

According to the versions of the perl-Archive-Tar packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory...

EulerOS 2.0 SP12 : python-pip (EulerOS-SA-2026-3301)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...

NewStart CGSL MAIN 7.02 : perl-Archive-Tar Multiple Vulnerabilities (NS-SA-2026-0090)

The remote NewStart CGSL host, running version MAIN 7.02, has perl-Archive-Tar packages installed that are affected by multiple vulnerabilities: - Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. makespecialfile passes...

EulerOS 2.0 SP12 : perl-Archive-Tar (EulerOS-SA-2026-3365)

According to the versions of the perl-Archive-Tar packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory...