CVE-2026-85396

A flaw was found in rubyzip. This path traversal vulnerability in the Zip::Entryextract function allows a remote attacker to craft malicious archive entries. By failing to properly validate extraction paths, the vulnerability enables an attacker to write files outside the intended extraction...

CVE-2026-85396 rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

EUVD-2026-70673

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

CVE-2026-85396 rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

CVE-2026-85396 rubyzip before 3.4.0 Path Traversal in Zip::Entry#extract via Sibling-Directory Prefix

rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../uploadbackup/owned.sh to write files outside the...

CVE-2026-82525

Exterro FTK Imager before 8.3 contains an XML external entity XXE injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XSLT stylesheets within a Report.xml file inside a UFDR ZIP...

CVE-2026-82525 Exterro FTK Imager < 8.3 XXE via Report.xml XSLT Processing

Exterro FTK Imager before 8.3 contains an XML external entity XXE injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XSLT stylesheets within a Report.xml file inside a UFDR ZIP...

CVE-2026-82525 Exterro FTK Imager < 8.3 XXE via Report.xml XSLT Processing

Exterro FTK Imager before 8.3 contains an XML external entity XXE injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XSLT stylesheets within a Report.xml file inside a UFDR ZIP...

SUSE-SU-2026:23612-1 Security update for cpio

This update for cpio fixes the following issues: - CVE-2026-66484: improper sanitization in the tar archive extraction functionality allows for the creation of hard links outside intended directory via malicious tar archives bsc1274856. - CVE-2026-66485: improper memory management in the makepath...

ROOT-APP-GOBINARY-CVE-2026-17106 CVE-2026-17106 in github.com/moby/go-archive - Patched by Root

Root has patched CVE-2026-17106 in the github.com/moby/go-archive package for Root:Go. Multiple fixed versions available...

PT-2026-85065

Name of the Vulnerable Software and Affected Versions Exterro FTK Imager versions prior to 8.3 Description An XML external entity XXE injection exists where attackers can read arbitrary files from the host filesystem. This is achieved by embedding malicious external entity references and...

Linux Distros Unpatched Vulnerability : CVE-2026-53600

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis- applies a buffered PAX size extension to an intermedia...

PT-2026-85229

Name of the Vulnerable Software and Affected Versions rubyzip versions prior to 3.4.0 Description An issue exists in the Zip::Entryextract function that allows for path traversal. The software fails to properly validate extraction paths when using prefix comparison without trailing separators. Th...

Oracle Linux 10 : ELSA-2026-61586-0: / tar (ELSA-2026-615860)

The remote Oracle Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-615860 advisory. - Backport upstream patches for CVE-2026-18477, fixes a bug where incremental restore with cyclic renames between backups may create a temporary...

GO-2026-6314 Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory in github.com/aquaproj/aqua

Aqua's archive extraction follows attacker-planted symlinks, allowing writes outside the install directory in github.com/aquaproj/aqua...

UBUNTU-CVE-2026-84838

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

EUVD-2026-70200

async-tar is a tar archive reading/writing library for async Rust. Prior to version 0.6.1, async-tar mis-applies a buffered PAX size extension to an intermediary extension header a GNU longname L, a GNU longlink K, or a PAX x/g header instead of to the next file entry. POSIX requires a PAX...

CVE-2026-84838

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload through the extract process. An attacker can execute arbitrary PHP code on the server by uploading a ZIP archive containing PHP-executable files and extracting them into a web-accessible directory. This is only...

RLSA-2026:61903 Important: php:8.2 security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Service via circular symbolic links in phar archives CVE-2026-7260 Bug Fixes and Enhancements...