openssh: openssh: sftp can write outside the destination directory from a server-supplied path

A flaw was found in OpenSSH. During an sftp copy, a malicious server can supply an empty name, a slash-only path, or a ".." basename that sftp uses as the local destination, writing outside the directory the user selected...

PT-2026-104392

Name of the Vulnerable Software and Affected Versions image-downloader version 4.3.0 Description A path traversal issue exists where an attacker who can control the download URL can cause the downloaded response data to be written outside the configured destination directory. Path traversal is a...

Rocky Linux 9 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc (crlsa-2026_54268)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202654268 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding description...

Rocky Linux 9 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc (crlsa-2026_59009)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202659009 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding description...

Rocky Linux 8 [CIQ] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (crlsa-2026_56219)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202656219 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding description...

Rocky Linux 8 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc (crlsa-2026_58971)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202658971 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding description...

Rocky Linux 10.2 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc (crlsa-2026_58902)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202658902 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding...

Rocky Linux 10.2 [CIQ] Security Update: python3.14 / python3.14-debug / python3.14-debuginfo / etc (crlsa-2026_58928)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202658928 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack through the handling of the destination directory in the non-daemon receiver. An attacker can redirect file writes to unintended filesystem locations by manipulating parent components of the destination path and...

AZL-95816 CVE-2026-53796 affecting package rsync for versions less than 3.5.0-1

rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can...

CVE-2026-53796

rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can...

CVE-2026-53796 rsync < 3.5.0 TOCTOU Race Condition via Destination Directory Handling

rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can...

PT-2026-71634

Name of the Vulnerable Software and Affected Versions rsync versions prior to 3.5.0 Description A time-of-check to time-of-use TOCTOU race condition exists in the non-daemon receiver's destination directory handling. This occurs when an attacker manipulates parent components of the destination pa...

CVE-2026-53796: Improper Link Resolution Before File Access

rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can...

BIT-PYTHON-MIN-2026-11940 tarfile extraction filter bypass allows escaping the destination directory

tarfile.extractall with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower...

BIT-LIBPYTHON-2026-11940 tarfile extraction filter bypass allows escaping the destination directory

tarfile.extractall with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the hardlink's shallower...

CVE-2026-15789 Malicious client can bypass destination directory validation on local sources upload

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

CVE-2026-15789 Malicious client can bypass destination directory validation on local sources upload

A custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to have valid permissions to access the BuildKit control API to issue builds, e.g., bypass authentication, etc...

CVE-2026-15789

CVE-2026-15789 affects the BuildKit daemon: a custom client with valid BuildKit API access can craft upload requests that bypass destination directory validation, allowing files to escape the BuildKit-controlled state directory. This is a local-privilege issue that requires access to the BuildKit...

GHSA-V23M-CCFG-PQ9H pnpm: `stage download` writes outside its destination directory via manifest name/version traversal

Summary The staged-tarball filename traversal reported as GHSA-v23m-ccfg-pq9h / CAND-PNPM-038 is fixed on main by pnpm/pnpm12303, merged as 65443f4bdf1f0db9c8c7dc58fee25252607e9234. Before the fix, pnpm stage download derived a local filename from registry-controlled package name and version...