CVE-2026-43637-cornac

CVE-2026-43637: Path Traversal Tar Slip in Cornac via extractarchive Severity: High, CVSS 4.0 8.8 , Critical, CVSS 3.1 9.1assigned by VulnCheck, the CNA Vector v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N Vector v4.0: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Affected:...

CVE-2026-65320-fastcore

CVE-2026-65320: Path Traversal Tar Slip in fastcore via untardir Severity: Critical, CVSS 3.1 9.8 Vector v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Affected: fastcore = 2.2.30 Fixed in: Not fixed at time of writing CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory,...

CVE-2026-108597

Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal tar slip vulnerability in s3modelsdirtotarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to...

CVE-2026-108597

Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal tar slip vulnerability in s3modelsdirtotarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to...

CVE-2026-108597 Cohere Python SDK 5.11.0 through 7.2.0 Path Traversal via SageMaker Tar Extraction

Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal tar slip vulnerability in s3modelsdirtotarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to...

CVE-2026-108597

The Cohere Python SDK versions 5.11.0 through 7.2.0 are vulnerable to a path traversal (tar slip) vulnerability within the _s3_models_dir_to_tarfile function. The root cause is the use of unvalidated tarfile.extractall() calls, which allows an attacker who can write model archives to the victim's...

EUVD-2026-96395

Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal tar slip vulnerability in s3modelsdirtotarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to...

PT-2026-109738

Name of the Vulnerable Software and Affected Versions Cohere Python SDK versions 5.11.0 through 7.2.0 Description A path traversal tar slip issue exists in the s3 models dir to tarfile function. This occurs due to unvalidated tarfile.extractall calls, which allow arbitrary file writes. An attacke...

CVE-2026-108597: Improper Limitation of a Pathname to a Restricted Directory

Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal tar slip vulnerability in s3modelsdirtotarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to...

Exploit for CVE-2026-65320

CVE-2026-65320: Path Traversal Tar Slip in fastcore via unt...

RUSTSEC-2026-0328 `decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)

The tar-family extractors in decompress .tar, .tar.gz, .tar.xz, .tar.bz2, .tar.zst build each output path from the raw archive entry path and write to it with no traversal check, so a malicious archive can write files outside the destination directory, a "tar-slip" / zip-slip path traversal CWE-2...

`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)

The tar-family extractors in decompress .tar, .tar.gz, .tar.xz, .tar.bz2, .tar.zst build each output path from the raw archive entry path and write to it with no traversal check, so a malicious archive can write files outside the destination directory, a "tar-slip" / zip-slip path traversal CWE-2...

PT-2026-105981

The tar-family extractors in decompress .tar, .tar.gz, .tar.xz, .tar.bz2, .tar.zst build each output path from the raw archive entry path and write to it with no traversal check, so a malicious archive can write files outside the destination directory, a "tar-slip" / zip-slip path traversal CWE-2...

Nx: Zip-Slip in the self-hosted remote cache

Summary The Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious — or on-path MITM — remote cache server can return a crafted tar archive whose entries escape the cache directory and write to arbitrary locations on the...

CVE-2026-43637 Cornac < 2.6.0 Path Traversal via _extract_archive() in download.py

Cornac before 2.6.0 contains a path traversal Tar Slip vulnerability that allows attackers to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries to the extractarchive function in...

PT-2026-60172

Cornac before 2.6.0 contains a path traversal Tar Slip vulnerability that allows attackers to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries to the extract archive function in...

CVE-2026-43637: Improper Limitation of a Pathname to a Restricted Directory

Cornac before 2.6.0 contains a path traversal Tar Slip vulnerability that allows attackers to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries to the extractarchive function in...

CVE-2026-55852 Frappe: TarSlip RCE in Package Import

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently checked before extraction. This issue is fixed in versions 16.23.0 and 15.112.0...

CVE-2026-55852 Frappe: TarSlip RCE in Package Import

Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently checked before extraction. This issue is fixed in versions 16.23.0 and 15.112.0...

PT-2026-57325

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 16.23.0 Frappe versions prior to 15.112.0 Description A TarSlip Remote Code Execution RCE issue exists in the Package Import feature. This occurs because members of tarfiles are not sufficiently validated before...