CVE-2019-25471 FileThingie 2.5.7 Arbitrary File Upload via ft2.php

FileThingie 2.5.7 contains an arbitrary file upload vulnerability that allows attackers to upload malicious files by sending ZIP archives through the ft2.php endpoint. Attackers can upload ZIP files containing PHP shells, use the unzip functionality to extract them into accessible directories, an...

PT-2026-24893

Name of the Vulnerable Software and Affected Versions yauzl version 3.2.0 Description yauzl, also known as Yet Another Unzip Library, version 3.2.0 for Node.js contains an off-by-one error within the getLastModDate function, specifically in the NTFS extended timestamp extra field parser. The...

PT-2026-24769

FileThingie 2.5.7 contains an arbitrary file upload vulnerability that allows attackers to upload malicious files by sending ZIP archives through the ft2.php endpoint. Attackers can upload ZIP files containing PHP shells, use the unzip functionality to extract them into accessible directories, an...

Arbitrary File Write via Validation/Extraction Path Mismatch in nltk.downloader._unzip_iter()

Description The current Zip Slip hardening in nltk.downloader.validatemember assumes that the path validated with: os.path.abspathos.path.joinroot, member os.path.realpathos.path.joinroot, member is the same path that zipfile.extractmember, root will later write to. That assumption is false for...

SUSE CVE-2025-14009

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The unzipiter function in nltk/downloader.py uses zipfile.extractall without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when...

CVE-2025-14009

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The unzipiter function in nltk/downloader.py uses zipfile.extractall without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when...

Arbitrary Code Injection

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Arbitrary Code Injection via the unzipiter function due to the lack of validation before unpacking untrusted downloaded packages. An attacker c...

CVE-2025-14009 Zip Slip Vulnerability in nltk/nltk Leading to Remote Code Execution

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The unzipiter function in nltk/downloader.py uses zipfile.extractall without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when...

NLTK 安全漏洞

NLTK is an open-source natural language toolkit developed by NLTK. It is used to support research and development in natural language processing. NLTK has a security vulnerability that stems from the unzipiter function using zipfile.extractall without performing path validation or security checks...

Low: unzip

Issue Overview: Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service resource consumption, aka a "better zip bomb" issue. CVE-2019-13232 Affected Packages: unzip Issue Correction: Run dnf update unzip --releasever 2023.10.20260202 or dnf upda...

Amazon Linux 2023 : unzip (ALAS2023-2026-1422)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1422 advisory. Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service resource consumption, aka a better zip bomb issue. CVE-2019-13232 Tenable has extracted the...

MiracleLinux 7 : unzip-6.0-21.el7 (AXSA:2020-4547:01)

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2020-4547:01 advisory. unzip: overlapping of files in ZIP container leads to denial of service CVE-2019-13232 Tenable has extracted the preceding description block directly from th...

MiracleLinux 8 : unzip-6.0-43.el8 (AXSA:2020-297:02)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2020-297:02 advisory. unzip: overlapping of files in ZIP container leads to denial of service CVE-2019-13232 Tenable has extracted the preceding description block directly from the...

MiracleLinux 7 : unzip-6.0-20.el7 (AXSA:2019-4176:01)

The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2019-4176:01 advisory. unzip: Buffer overflow in list.c resulting in a denial of service CVE-2018-18384 Tenable has extracted the preceding description block directly from the...

undici 安全漏洞

undici is an open source HTTP/1.1 client for Node.js. A security vulnerability exists in undici versions prior to 7.18.0 and prior to 6.23.0, which stems from an unlimited number of links in an unzip chain, and could lead to high CPU usage and memory over-allocation...

GuardDog 安全漏洞

GuardDog is a CLI tool from GuardDog Open Source that allows identifying malicious PyPI packages. A security vulnerability exists in GuardDog versions prior to 2.7.1, which stems from the safeextract function not validating the unzipped file size, which could lead to a denial-of-service attack vi...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues

Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues. We have updated the base image used by our Speech Services and the following vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2021-3572...

Directory Traversal

alexusmai/laravel-file-manager is vulnerable to Directory Traversal. The vulnerability is due to insufficient validation of extraction paths during archive unzip functionality, which allows an attacker to write files to arbitrary locations on the filesystem...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the UnZip function. An attacker can write files to arbitrary locations on the filesystem by crafting archive files with malicious extraction paths. Details A Directory Traversal attack also known as path traversa...

alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality

alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to be written to arbitrary locations on the filesystem due to insufficient validation of extraction paths...