2212 matches found
jaraco.context path traversal vulnerability
jaraco.context is a Python library developed by Jason R. Coombs. Versions 5.2.0 to 6.1.0 of jaraco.context had a path traversal vulnerability. This vulnerability stemmed from the Zip Slip path traversal in the tarball functions, which could allow files to be extracted outside of the expected...
Linux Distros Unpatched Vulnerability : CVE-2026-23949
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via the extractPackageTarball function. An attacker can write arbitrary files to the filesystem by supplying a malicious tar file containing absolute paths. Note: This vulnerability results from an incomplete fix of...
CVE-2026-22249
Docmost is an open-source collaborative wiki and documentation software. From 0.21.0 to before 0.24.0, Docmost is vulnerable to Arbitrary File Write via Zip Import Feature ZipSlip. In apps/server/src/integrations/import/utils/file.utils.ts, there are no validation on filename. This vulnerability ...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004351)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004351 advisory. In the Linux kernel before 5.4.16, a race condition in tty-discdata handling in the slip and slcan line discipline could lead to a use-after-free, aka...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003924)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003924 advisory. In the Linux kernel before 5.4.16, a race condition in tty-discdata handling in the slip and slcan line discipline could lead to a use-after-free, aka...
CVE-2026-22249
Docmost is an open-source collaborative wiki and documentation software. From 0.21.0 to before 0.24.0, Docmost is vulnerable to Arbitrary File Write via Zip Import Feature ZipSlip. In apps/server/src/integrations/import/utils/file.utils.ts, there are no validation on filename. This vulnerability ...
CVE-2026-22249 Docmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip)
Docmost is an open-source collaborative wiki and documentation software. From 0.21.0 to before 0.24.0, Docmost is vulnerable to Arbitrary File Write via Zip Import Feature ZipSlip. In apps/server/src/integrations/import/utils/file.utils.ts, there are no validation on filename. This vulnerability ...
CVE-2026-22249
CVE-2026-22249—Docmost is affected in versions 0.21.0 through before 0.24.0. The vulnerability stems from an Arbitrary File Write via Zip Import (ZipSlip) in the import utility, where filename validation is missing in apps/server/src/integrations/import/utils/file.utils.ts. This can enable unauth...
CVE-2026-22249 Docmost affected by an Arbitrary File Write via Zip Import Feature (ZipSlip)
Docmost is an open-source collaborative wiki and documentation software. From 0.21.0 to before 0.24.0, Docmost is vulnerable to Arbitrary File Write via Zip Import Feature ZipSlip. In apps/server/src/integrations/import/utils/file.utils.ts, there are no validation on filename. This vulnerability ...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via the Delete function. An attacker can delete arbitrary files on the server by submitting crafted path traversal sequences in the path parameter. Details A Directory Traversal attack also known as path traversal ai...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-001887)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001887 advisory. The slhcinit function in drivers/net/slip/slhc.c in the Linux kernel through 4.2.3 does not ensure that certain slot numbers are valid, which allows local users to...
Directory Traversal
Overview guarddog is a GuardDog is a CLI tool to Identify malicious PyPI packages Affected versions of this package are vulnerable to Directory Traversal via the safeextract function. An attacker can overwrite arbitrary files and potentially execute code by crafting a malicious archive with path...
GHSA-58PV-8J8X-9VJ2 jaraco.context Has a Path Traversal Vulnerability
Summary There is a Zip Slip path traversal vulnerability in the jaraco.context package affecting setuptools as well, in jaraco.context.tarball function. The vulnerability may allow attackers to extract files outside the intended extraction directory when malicious tar archives are processed. The...
PT-2026-3523
Name of the Vulnerable Software and Affected Versions jaraco.context versions prior to 6.1.0 Description jaraco.context, a software package providing decorators and context managers, contains a path traversal issue in the jaraco.context.tarball function. The issue allows attackers to extract file...
Directory Traversal
Overview MindsDB is a MindsDB server, provides server capabilities to mindsdb native python library Affected versions of this package are vulnerable to Directory Traversal via the PUT handler in the file upload API, which directly joins user-supplied input into a filesystem path without proper...
CVE-2026-22685 DevToys Path Traversal (“Zip Slip”) Vulnerability in DevToys Extension Installation
DevToys is a desktop app for developers. In versions from 2.0.0.0 to before 2.0.9.0, a path traversal vulnerability exists in the DevToys extension installation mechanism. When processing extension packages NUPKG archives, DevToys does not sufficiently validate file paths contained within the...
CVE-2026-22685 DevToys Path Traversal (“Zip Slip”) Vulnerability in DevToys Extension Installation
DevToys is a desktop app for developers. In versions from 2.0.0.0 to before 2.0.9.0, a path traversal vulnerability exists in the DevToys extension installation mechanism. When processing extension packages NUPKG archives, DevToys does not sufficiently validate file paths contained within the...
CVE-2026-22685
DevToys (desktop app) has a path traversal vulnerability in its extension installation for versions 2.0.0.0–2.0.8.x, where processing NUPKG archives does not validate file paths, allowing crafted entries like ../../…/target-file to write outside the intended extensions directory. This could overw...