Rocky Linux 9.6 [TuxCare] Security Update: plexus-utils / plexus-utils-javadoc (ALMALINUX9.6:CLSA-2026:1777454474)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777454474 advisory. - Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus- utils before...

Rocky Linux 9 [CIQ] Security Update: python3.12 / python3.12-debug / python3.12-debuginfo / etc (crlsa-2026_59009)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202659009 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding description...

Rocky Linux 8 [CIQ] Security Update: ant / ant-antlr / ant-apache-bcel / ant-apache-bsf / etc (crlsa-2026_41948)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202641948 advisory. org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVE-2025-67030 Tenable has extracted the preceding description block...

Rocky Linux 10.2 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc (crlsa-2026_58902)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202658902 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding...

Rocky Linux 9 [CIQ] Security Update: aopalliance / apache-commons-cli / apache-commons-codec / etc (crlsa-2026_38500)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202638500 advisory. org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVE-2025-67030 Tenable has extracted the preceding description block...

Rocky Linux 10.2 [CIQ] Security Update: plexus-utils / plexus-utils-javadoc (crlsa-2026_38514)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202638514 advisory. org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVE-2025-67030 Tenable has extracted the preceding description block...

Rocky Linux 10.0 [CIQ] Security Update: perl / perl-Attribute-Handlers / perl-AutoLoader / perl-AutoSplit / etc (crlsa-2025_12056)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202512056 advisory. perl: Perl threads have a working directory race condition where file operations may target unintended paths CVE-2025-40909 Tenable has extracted the preceding...

GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution

Summary Repo.init decides which directory is the git directory by testing candidate paths in an order that considers the real .git last. Two earlier tests can be satisfied by ordinary tracked files. Git reserves only the literal name .git, so HEAD, objects/, refs/, config, gitdir, commondir and...

EUVD-2026-74843

GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via a drive designator URI in TemplateLookup.gettemplate on Windows. The directory traversal check in Template.init normalizes the URI using os.path which on Windows is ntpath, while TemplateLookup.gettemplate resolv...

rsync: rsync: Directory escape via TOCTOU race condition in rrsync

A time-of-check to time-of-use TOCTOU race condition flaw in the rrsync restricted shell wrapper allows authenticated remote attackers to escape directory restrictions. By replacing a validated path component with a symbolic link prior to file transfer execution, an attacker can bypass intended...

CVE-2026-51860

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/taskexec.py...

CVE-2026-51864

DB-GPT v0.7.5 and v0.8.0 contains directory traversal in pythonfileupload packages/dbgpt-app/src/dbgptapp/openapi/apiv1/pythonuploadapi.py:42. A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary...

CVE-2026-51862

DB-GPT 0.8.0 contains directory traversal in skillupload packages/dbgpt-app/src/dbgptapp/openapi/apiv1/agenticdataapi.py:40. A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary...

CVE-2026-51859

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in savedownloadfile src/backend/bisheng/core/cache/utils.py:290...

CVE-2026-51853

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.init. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction...

CVE-2026-51852

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.savefileb64. The savefileb64 method accepts user-controlled file paths without normalization or validation, allowing path traversal attacks...

CVE-2026-102990

A flaw was found in basic-ftp. A malicious or compromised FTP server can cause a Denial of Service DoS by returning specially crafted Unix directory listings to the client. Inefficient regular expression processing during directory parsing leads to excessive CPU consumption, blocking the...

CLEANSTART-2024-WM30423 diffoscope before 256 allows directory traversal via an embedded filename in a GPG file

Security vulnerability affects the diffoscope package. diffoscope before 256 allows directory traversal via an embedded filename in a GPG file...

CLEANSTART-2026-EV76983 Previously, resolving relative paths containing parent directory ('

CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...