CVE-2026-88046: Improper Limitation of a Pathname to a Restricted Directory

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject parent-directory segments in source Object.Remote values before fs/list, fs/walk, fs/sync, and fs/operations pass those values to destination...

biliarchiver (>=0.1.11, <=0.1.20), pv-surrogate-data (>=1.0.0, <=1.0.2) +3 more potentially affected by CVE-2025-58438 via internetarchive (4.1.0)

internetarchive PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on internetarchive and may be impacted: - biliarchiver =0.1.11, =1.0.0, =4.3.0, =4.4.2 - wikiteam3-fork-proxy 1.0.0 Source cves: CVE-2025-58438 Source advisory:...

biliarchiver (>=0.0.9, <=0.1.9), dokuwikidumper (>=0.1.1, <=0.1.46) +9 more potentially affected by CVE-2025-58438 via internetarchive (3.7.0)

internetarchive PYPI version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on internetarchive and may be impacted: - biliarchiver =0.0.9, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =0.0.1, =1.114.0, =3.9.0, =4.2.6 Source cves: CVE-2025-58438 Source...

tocky (>=0.0.1, <=0.0.17) potentially affected by CVE-2025-58438 via internetarchive (3.5.0)

internetarchive PYPI version 3.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on internetarchive and may be impacted: - tocky =0.0.1, =0.0.17 Source cves: CVE-2025-58438 Source advisory: OSV:PYSEC-2026-357...

satnogs-network (>=1.92.0, <=1.113.0) potentially affected by CVE-2025-58438 via internetarchive (3.0.2)

internetarchive PYPI version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on internetarchive and may be impacted: - satnogs-network =1.92.0, =1.113.0 Source cves: CVE-2025-58438 Source advisory: OSV:PYSEC-2026-357...

obgp (>=0.0.36, <=0.0.42) potentially affected by CVE-2025-58438 via internetarchive (3.0.0)

internetarchive PYPI version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on internetarchive and may be impacted: - obgp =0.0.36, =0.0.42 Source cves: CVE-2025-58438 Source advisory: OSV:PYSEC-2026-357...

data-portal-archiver (>=0.0.1, <=0.1.14), gharbala (>=0.1.1, <=0.1.9) potentially affected by CVE-2025-58438 via internetarchive (2.3.0)

internetarchive PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on internetarchive and may be impacted: - data-portal-archiver =0.0.1, =0.1.1, =0.1.9 Source cves: CVE-2025-58438 Source advisory: OSV:PYSEC-2026-357...

curation-utils (0.1.4) potentially affected by CVE-2025-58438 via internetarchive (1.9.9)

internetarchive PYPI version 1.9.9 is affected by a known vulnerability. The following packages have a transitive dependency on internetarchive and may be impacted: - curation-utils 0.1.4 Source cves: CVE-2025-58438 Source advisory: OSV:PYSEC-2026-357...

osf-pigeon (0.0.2) potentially affected by CVE-2025-58438 via internetarchive (1.9.4)

internetarchive PYPI version 1.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on internetarchive and may be impacted: - osf-pigeon 0.0.2 Source cves: CVE-2025-58438 Source advisory: OSV:PYSEC-2026-357...

openlibrary-client (0.0.30), openlibrary-client-mek (0.0.30) potentially affected by CVE-2025-58438 via internetarchive (1.9.0)

internetarchive PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on internetarchive and may be impacted: - openlibrary-client 0.0.30 - openlibrary-client-mek 0.0.30 Source cves: CVE-2025-58438 Source advisory: OSV:PYSEC-2026-357...

generativepoetry (>=0.3.0, <=0.3.4), kdap (>=0.1.25, <=0.1.29) +1 more potentially affected by CVE-2025-58438 via internetarchive (1.8.5)

internetarchive PYPI version 1.8.5 is affected by a known vulnerability. The following packages have a transitive dependency on internetarchive and may be impacted: - generativepoetry =0.3.0, =0.1.25, =0.1.0, =0.1.1 Source cves: CVE-2025-58438 Source advisory: OSV:PYSEC-2026-357...

ia-markov (>=0.2.1, <=0.3.1) potentially affected by CVE-2025-58438 via internetarchive (1.8.1)

internetarchive PYPI version 1.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on internetarchive and may be impacted: - ia-markov =0.2.1, =0.3.1 Source cves: CVE-2025-58438 Source advisory: OSV:PYSEC-2026-357...

tubeup (0.0.13) potentially affected by CVE-2025-58438 via internetarchive (1.7.6)

internetarchive PYPI version 1.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on internetarchive and may be impacted: - tubeup 0.0.13 Source cves: CVE-2025-58438 Source advisory: OSV:PYSEC-2026-357...

openlibrary-client (0.0.18) potentially affected by CVE-2025-58438 via internetarchive (1.7.3)

internetarchive PYPI version 1.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on internetarchive and may be impacted: - openlibrary-client 0.0.18 Source cves: CVE-2025-58438 Source advisory: OSV:PYSEC-2026-357...

ia-markov (>=0.1.0, <=0.2.0) potentially affected by CVE-2025-58438 via internetarchive (1.1.0)

internetarchive PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on internetarchive and may be impacted: - ia-markov =0.1.0, =0.2.0 Source cves: CVE-2025-58438 Source advisory: OSV:PYSEC-2026-357...

PYSEC-2026-357 internetarchive Vulnerable to Directory Traversal in File.download()

Impact What kind of vulnerability is it? This is a Critical severity directory traversal path traversal vulnerability in the File.download method of the internetarchive library. Who is impacted? All users of the internetarchive library versions 5.5.1 are impacted. The vulnerability is particularl...

wikiteam3 (>=4.4.3, <=4.4.7) potentially affected by CVE-2025-58438 via internetarchive (5.4.1)

internetarchive PYPI version 5.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on internetarchive and may be impacted: - wikiteam3 =4.4.3, =4.4.7 Source cves: CVE-2025-58438 Source advisory: OSV:PYSEC-2026-357...

Ubuntu: Security Advisory (USN-7989-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-6035-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DSA 6035-1] python-internetarchive security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6035-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 23, 2025 https://www.debian.org/security/faq -...