CVE-2026-101894

CVE-2026-101894 — @xhmikosr/decompress traversal de rutas mediante cadena de symlinks PoC en Python 3 para CVE-2026-101894 — la extracción de archivos de Node.js en @xhmikosr/decompress y en el paquete sin mantenimiento decompress permite leer/escribir fuera del directorio de salida mediante una...

SUSE-SU-2026:4417-1 Security update for helm

This update for helm fixes the following issues: - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction bsc1281104. - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows...

GO-2026-6499 Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) in oras.land/oras-go

Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction pushDir in oras.land/oras-go...

@xhmikosr/decompress: Path traversal via symlink chain

Impact When extracting an untrusted archive with the default decompressinput, output API, a crafted archive containing a chain of symlink entries can make a later entry resolve outside the output directory. The lexical containment checks pass, but the kernel follows the planted symlinks to a path...

NPM: @xhmikosr/decompress: Path traversal via symlink chain

NPM: @xhmikosr/decompress: Path traversal via symlink chain vulnerability discovered by ? in WordPress Npm decompress versions = 4.2.1...

CVE-2026-101894 @xhmikosr/decompress: Path traversal via symlink chain

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

CVE-2026-101894

The decompress package for Node.js is vulnerable to a path traversal flaw due to inadequate lexical containment checks. An attacker can provide a crafted archive with chained symlink entries to bypass directory restrictions, allowing them to read or write files outside the intended output directo...

CVE-2026-101894 @xhmikosr/decompress: Path traversal via symlink chain

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

CVE-2026-101894 @xhmikosr/decompress: Path traversal via symlink chain

The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

Linux Distros Unpatched Vulnerability : CVE-2026-85731

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can...

EUVD-2026-80873

oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction pushDir...

CVE-2026-85731

A flaw was found in oras-go, a Go library for managing OCI Open Container Initiative artifacts. A remote attacker can exploit a symlink-chain bypass vulnerability during tar extraction of OCI layers. This allows a malicious archive to create or overwrite any file writable by the process outside t...

CVE-2026-85731

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2 , the content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true is vulnerable to an arbitrary file-write outside the store's working directory. The root cause lies in the pushDir path: extractTarDire...

CVE-2026-85731 oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets...

CVE-2026-85731 oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets...

CVE-2026-85731 oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets...

CVE-2026-55828 qbee transport: Symlink-chain path traversal in tar extraction (one level outside destination)

qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or...

CVE-2026-55828 qbee transport: Symlink-chain path traversal in tar extraction (one level outside destination)

qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or...

CVE-2026-55828

go.qbee.io/transport , a remote access transport protocol implementation, is affected by a symlink-chain path traversal in its extractTar routine prior to v1.26.25 . The root cause is that path validation is strictly lexical and does not account for on-disk symlinks created earlier during extract...

CVE-2026-55828 qbee transport: Symlink-chain path traversal in tar extraction (one level outside destination)

qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or...