CVE-2026-29786

CVE-2026-29786 Investigación: Joshua van Rijswijk Descripción Este repositorio contiene una Prueba de Concepto PoC para CVE-2026-29786 , una vulnerabilidad en el paquete npm tar que permite que un archivo manipulado cree un enlace duro hardlink que apunta fuera del directorio de extracción...

CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

CLEANSTART-2026-NP36052 Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data"

Security vulnerability affects the airflow-3 package. Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data"...

EulerOS 2.0 SP12 : perl-Archive-Tar (EulerOS-SA-2026-3365)

According to the versions of the perl-Archive-Tar packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory...

SUSE CVE-2026-18477

A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...

OESA-2026-3234 python-Keras security update

Keras is a high-level neural networks API for Python. Security Fixes: Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in keras/src/utils/fileutils.py. The functions filtersafetarinfos and filtersafezipinfos validate archive membe...

UBUNTU-CVE-2026-18477

A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...

SUSE CVE-2026-47078

Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integer...

CVE-2026-47078

A flaw was found in the Erlang OTP stdlib zip module. The zip:unzip and zip:extract functions, which handle archive extraction, are vulnerable to a relative path traversal attack. A remote attacker could craft a malicious zip archive containing specially formed entry names. When processed, this...

Linux Distros Unpatched Vulnerability : CVE-2026-47078

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive...

DEBIAN-CVE-2026-47078

Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integer...

EUVD-2026-49317

Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integer...

CVE-2026-47078

Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integer...

EEF-CVE-2026-47078 Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass

Summary Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integ...

PT-2026-64979

Name of the Vulnerable Software and Affected Versions Erlang OTP versions 27.1 through 27.3.4.14 Erlang OTP versions 28.0 through 28.5.0.3 Erlang OTP versions 29.0 through 29.0.3 Description A relative path traversal issue in the stdlib zip module allows writing files outside the intended...

CVE-2026-12482

A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the filtersafetarinfos validation in keras/src/utils/fileutils.py. Specifically, symlink entries are not subjected to the same ispathindir validation as regular file entries,...

Symlink Attack

Overview decompress is a package that can be used for extracting archives. Affected versions of this package are vulnerable to Symlink Attack in the symlink handling process. An attacker can create arbitrary symbolic links outside the intended extraction directory by crafting an archive with...

CVE-2026-59820

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives, allowing an authenticated user with access to LiteLLM LLM API routes or a key whos...

CVE-2026-59820

LiteLLM is a proxy AI gateway. A path traversal flaw existed in LiteLLM Skills archive extraction prior to version 1.83.7-stable, where uploaded skill ZIPs could write outside the intended extraction directory when an authenticated user accessed LLM API routes or held a key with /v1/skills, anthr...

CVE-2026-59820 LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to 1.83.7-stable, LiteLLM Skills archive extraction did not sufficiently validate file paths from uploaded skill ZIP archives, allowing an authenticated user with access to LiteLLM LLM API routes or a key whos...