109 matches found
CVE-2026-111448
Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct...
CVE-2026-111448
Wheels versions 4.0.0 through 4.1.2 are vulnerable to a path containment flaw because they use case-insensitive comparisons on case-sensitive filesystems. This allows an attacker to use an existing symlink to a case-distinct sibling directory to bypass checks for zip entries, package mappings, de...
EUVD-2026-102601
Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct...
CVE-2026-111448
Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks for zip entries, package mappings, development assets/docs, guide images and image tags can accept paths through an existing symlink to a case-distinct...
CVE-2026-102663
Prior to version 4.2.4 , OpenList is vulnerable to unauthorized disclosure of file metadata and existence information due to a non-separator-aware path check in the search API. When Bleve search is enabled, an authenticated user with restricted access can exploit a flawed strings.HasPrefix compar...
PT-2026-103630
Name of the Vulnerable Software and Affected Versions DeepWiki-Open versions prior to commit d92819a Description An unauthenticated arbitrary file read issue exists in the 'GET /codemap/file' endpoint. By providing a non-URL value to the repo url parameter, an attacker can bypass path containment...
CVE-2026-82455
This flaw has been rejected by upstream RubyGems maintainers Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or...
CVE-2026-87976
Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...
Linux Distros Unpatched Vulnerability : CVE-2026-82455
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination...
AZL-98403 CVE-2026-82455 affecting package ruby 3.3.5-9
RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...
CVE-2026-82455
Rejected reason: The RubyGems maintainers determined that the reported symlink-following behavior during gem extraction is not a security vulnerability, so no vulnerability exists for this record to describe...
CVE-2026-82455
Rejected reason: The RubyGems maintainers determined that the reported symlink-following behavior during gem extraction is not a security vulnerability, so no vulnerability exists for this record to describe...
UBUNTU-CVE-2026-82455
RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...
CVE-2026-82455
RubyGems before 4.0.13 fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files can be written outside the intended directory, breaking the extr...
EUVD-2026-68102
RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...
CVE-2026-82455 RubyGems before 4.0.13 Path Traversal via Symlink Resolution
RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...
CVE-2026-82455
Removed by vendor...
PT-2026-83434
Name of the Vulnerable Software and Affected Versions RubyGems versions prior to 4.0.13 Description RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. If a pre-existing symlink within the destination directory points outside the extraction...
PT-2026-88158
RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...
BIT-PYTHON-2026-19672 tarfile extraction filter bypass allows creation of directories outside the destination
The tarfile module's tar and data extraction filters created directories outside the destination for members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The containment check used the resolved path, but intermediate directories were created from the name...