CVE-2007-4559

demonstration of CVE-2007-4559 what is this? This is a demonstration of how python's default handling of tar file extraction prior to python v3.11.4 is vulnerable to a simple symlink attack. The instructions below describe how to craft a malicious payload. The script untar.py demonstrates how and...

CVE-2026-23745

CVE-2026-23745: node-tar Arbitrary File Overwrite Research: Joshua van Rijswijk Description PoC for CVE-2026-23745 , a high-severity path traversal vulnerability in node-tar 7.5.2. The library fails to sanitize absolute paths in the linkpath field for Hardlinks and Symlinks. This allows malicious...

wargame-tarpioka

BubbleTea CVE-2007-4559 Directory traversal vulnerability using .tar to ../../flag path BubbleTea/ ├── Dockerfile ├── flag ├── requirements.txt └── src ├── files ├── template │ └── index.html └── app.py Current Building Instructions check docker docker ps docker images docker build -t tarpioka...

CopyEscape-CVE-2026-17106

CopyEscape: Taking Over Docker Hosts with docker cp CVE-2026-17106 This is the proof-of-concept repository for the blog post CopyEscape: Taking Over Docker Hosts withdocker cp — CVE-2026-17106. CopyEscape allows a malicious running container to race Docker's archive producer and create an...

cve-tarmageddon

CVE-2025-62518: TARmageddon This repository demonstrates a critical bug in tokio-tar and related async Rust tar libraries where PAX extended header size overrides are not applied before calculating the next header position. Bug Summary Root Cause: When processing tar files with PAX extended heade...

CVE-2026-31802

🛡️ CVE-2026-31802 - Simple Proof of Concept Viewer 📋 About CVE-2026-31802 This repository provides a proof of concept PoC and write-up for CVE-2026-31802. The issue is a security vulnerability in the npm tar package. It allows attackers to trick the software into writing files outside its allowed...

wildpwn

First things first! Read: https://www.exploit-db.com/papers/33930/ Basic usage It goes something like this: usage: wildpwn.py -h --file FILE payload folder Tool to generate unix wildcard attacks positional arguments: payload Payload to use: combined | tar | rsync folder Where to write the payload...

PoC-for-CVE-2020-28948-CVE-2020-28949

POC for CVE-2020-28948 & CVE-2020-28949 The files here contain PoC for CVE-2020-28948 & CVE-2020-28949 to achieve remote exploit The server The server folder contains a simple upload server which uses the vulnerable ArchiveTar library, located in server/Archive. The server accepts a Tar archive...

CVE-2024-12905-PoC

CVE-2024-12905 tar-fs file write/overwrite vulnerability...

CVE-2026-44402

CVE-2026-44402 Pre-Authenticated Full Remote Command Execution in Voltronic Power SNMP Web Pro 1.1 Content Affected Vendor: https://voltronicpower.com/ Affected product: SNMP Web pro 1.1 SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi endpoint. T...

POC-CopyEscape-CVE-2026-17106

CopyEscape — PoC for CVE-2026-17106 Educational Proof of Concept of CopyEscape CVE-2026-17106, a TOCTOU race condition vulnerability in docker cp that allows a malicious container to write arbitrary files on the Docker host. Inspired by the original work of masasron , who discovered and documente...

CVE-2026-64824-PoC

CVE-2026-64824 — Home Assistant Core Backup-Restore Symlink Path Traversal → RCE CVSS 8.4 Critical · GHSA-cwh8-w64c-4j5h · CWE-22 / CWE-59 TL;DR Authenticated admin attacker uploads a crafted backup tar. The restore path extracts the inner homeassistant.tar.gz with filter="fullytrusted" and only...

CVE-2026-77156

Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS used when installing the Vorpal ASCA real-time engine and the SCA Resolver would allow a malicious tar archive containing absolute or traversal path entries to write files outside the insta...

CVE-2026-77156

The ast-cli tool is vulnerable to a path traversal flaw during tar extraction on Linux and macOS platforms. The root cause is incomplete validation of extracted archive entry paths, which can be exploited by a malicious archive containing absolute or traversal path entries to write files outside ...

CVE-2026-77156 ast-cli: Path traversal in tar extraction on Linux/macOS allows writes outside the install directory

Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS used when installing the Vorpal ASCA real-time engine and the SCA Resolver would allow a malicious tar archive containing absolute or traversal path entries to write files outside the insta...

EUVD-2026-108269

Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS used when installing the Vorpal ASCA real-time engine and the SCA Resolver would allow a malicious tar archive containing absolute or traversal path entries to write files outside the insta...

cve-2025-32434-poc

CVE-2025-32434 Description Technical Details The vulnerability entry point is load in torch/serialization.py when protection weightsonly is enabled: loading a tar file would call these functions in chain: 1. load: torch/serialization.py:1117 2. loadlegacy: torch/serialization.py:1376 to...

CVE-2026-43637-cornac

CVE-2026-43637: Path Traversal Tar Slip in Cornac via extractarchive Severity: High, CVSS 4.0 8.8 , Critical, CVSS 3.1 9.1assigned by VulnCheck, the CNA Vector v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N Vector v4.0: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Affected:...

CVE-2025-59284-PoC

CVE-2025-59284-PoC Proof of concept for CVE-2025-59284 libarchive exploit usage: Usage: Poc.py e.g python poc.py test.pdf '\IP\Share\test.pdf' pdf.tar Technical writeup: https://sec-fault.com/blog/cve-2025-59284/ Video...

Security update for php7

This update for php7 fixes the following issues: CVE-2025-1218: php: php: Denial of Service via out-of-bounds read in mysqlnd wire protocol parser bsc1282981. CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing bsc1283216. CVE-2026-6103: Archive entry injection via integer...