EUVD-2026-102528

unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in targetname in tar/parse-tar.c, reachable through the arentrygetname API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashi...

EUVD-2026-102529

unarr through 1.1.1 contains a heap-based out-of-bounds read in zipparseextrafields in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash...

CVE-2026-111273

unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in targetname in tar/parse-tar.c, reachable through the arentrygetname API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashi...

CVE-2026-111274

unarr through 1.1.1 contains a heap-based out-of-bounds read in zipparseextrafields in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash...

CVE-2026-111274

The software unarr through 1.1.1 is vulnerable to a heap-based out-of-bounds read within the zip_parse_extra_fields() function in zip/parse-zip.c. The root cause is an incorrect ZIP64 extra field length check . An attacker can exploit this by providing a crafted ZIP archive containing 0xFFFFFFFF ...

CVE-2026-111273 unarr through 1.1.1 Off-by-One Heap Buffer Overflow via tar_get_name

unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in targetname in tar/parse-tar.c, reachable through the arentrygetname API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashi...

CVE-2026-111273

The unarr software (versions through 1.1.1 ) is vulnerable to an off-by-one heap-based buffer overflow within the tar_get_name() function located in tar/parse-tar.c. This vulnerability is reachable through the ar_entry_get_name() API. An attacker can exploit this by providing a crafted TAR archiv...

EUVD-2021-2114

Malware in sbrugna...

GO-2022-0929 Tarslip in go-unarr in github.com/gen2brain/go-unarr

Tarslip in go-unarr in github.com/gen2brain/go-unarr...

GHSA-V9J4-CP63-QV62 Tarslip in go-unarr

unarr.go in go-unarr aka Go bindings for unarr 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive...

go-unarr directory traversal vulnerability

go-unarr is an open source go language library for decompressing RAR, TAR, ZIP and 7z archives. go-unarr version 0.1.1 is vulnerable to a directory traversal vulnerability that could be exploited to write arbitrary files on the system via specially crafted TAR archives...

CVE-2021-38197

unarr.go in go-unarr aka Go bindings for unarr 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive...

CVE-2021-38197

unarr.go in go-unarr aka Go bindings for unarr 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive...

Directory traversal

unarr.go in go-unarr aka Go bindings for unarr 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive...

CVE-2021-38197

unarr.go in go-unarr aka Go bindings for unarr 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive...

CVE-2021-38197

CVE-2021-38197 affects go-unarr (Go bindings for unarr) version 0.1.1, where a Directory Traversal flaw allows the use of .. in TAR archive paths to access files outside the intended directory. This vulnerability is corroborated across multiple sources (NVD entry, GHSA, OSV, Veracode, CNVD, and o...

CVE-2021-38197

unarr.go in go-unarr aka Go bindings for unarr 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive...

CVE-2021-38197

unarr.go in go-unarr aka Go bindings for unarr 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive...

PT-2021-22005 · Go-Unarr · Go-Unarr

Name of the Vulnerable Software and Affected Versions: go-unarr versions 0.1.1 Description: The issue allows Directory Traversal via ../ in a pathname within a TAR archive. This is possible due to a flaw in the unarr.go file in go-unarr. Recommendations: For go-unarr version 0.1.1, consider...

CVE-2021-38197: Improper Limitation of a Pathname to a Restricted Directory

unarr.go in go-unarr aka Go bindings for unarr 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive...