7300 matches found
CVE-2025-48387 tar-fs has issue where extract can write outside the specified dir with a specific tarball
tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore n...
CVE-2025-48387: Improper Limitation of a Pathname to a Restricted Directory
tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.0.9, 2.1.3, and 1.16.5 have an issue where an extract can write outside the specified dir with a specific tarball. This has been patched in versions 3.0.9, 2.1.3, and 1.16.5. As a workaround, use the ignore option to ignore n...
tar-fs 路径遍历漏洞
tar-fs is a tar-stream filesystem bundle by the individual developer Mathias Buus. A path traversal vulnerability exists in tar-fs versions prior to 3.0.9, which stems from the ability to write outside of a specified directory when extracting, potentially leading to arbitrary file writes...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Microsoft
CVE-2025-24071 PoC SMB + TAR Extraction Method This is a Po...
The vulnerability of the tar.vim plugin for the Vim text editor allows a hacker to execute arbitrary code.
The vulnerability of the tar.vim plugin for the Vim text editor is related to the lack of measures taken at the control level to clean up data. Exploiting this vulnerability allows an attacker to execute arbitrary code using specially created tar files...
CVE-2024-0129
NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe .tar file extraction. A successful exploit of this vulnerability may lead to code execution and data tampering...
CVE-2024-27261
IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.2 could allow a privileged user to install a potentially dangerous tar file, which could give them access to subsequent systems where the package was installed. IBM X-Force ID: 283986...
SUSE-SU-2025:20365-1 Security update for s390-tools
This update for s390-tools fixes the following issues: Revendored vendor.tar.zst CVE-2025-3416: Fixed use-after-free in Md::fetch and Cipher::fetch in rust-openssl crate bsc1242622 Added the new IBM z17 9175 processor type The package is built with the new 4096bit RSA secure boot signing key...
Security update for s390-tools
This update for s390-tools fixes the following issues: Revendored vendor.tar.zst CVE-2025-3416: Fixed use-after-free in Md::fetch and Cipher::fetch in rust-openssl crate bsc1242622 Added the new IBM z17 9175 processor type The package is built with the new 4096bit RSA secure boot signing key. Pat...
CVE-2024-24579
stereoscope is a go library for processing container images and simulating a squash filesystem. Prior to version 0.0.1, it is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary director...
CVE-2023-6908
A vulnerability, which was classified as problematic, was found in DFIRKuiper Kuiper 2.3.4. This affects the function unzipfile of the file kuiper/app/controllers/casemanagement.py of the component TAR Archive Handler. The manipulation of the argument dstpath leads to path traversal. It is possib...
CVE-2023-24057
HL7 Health Level 7 FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal from a crafted ZIP or TGZ archive for a prepackaged terminology cache, NPM package, or comparison archive...
CVE-2023-32676
Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the Install assessment functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted T...
CVE-2023-32317
Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the MOSS cheat checker functionality of Autolab. To exploit this vulnerability an authenticated attacker with instructor permissions needs to upload a specially crafted T...
CVE-2022-25358
A ..%2F path traversal vulnerability exists in the path handler of awful-salmonella-tar before 0.0.4. Attackers can only list directories not read files. This occurs because the safe-path? Scheme predicate is not used for directories...
CVE-2021-38197
unarr.go in go-unarr aka Go bindings for unarr 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive...
CVE-2020-5738
Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/uploadvpntar interface...
CVE-2018-20835
A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the...