Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
157 results · page 2 of 4
Nov 28, 2025Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.get_file() function when extracting tar archives.CVE-2025-12638 · Other software · keras-team · reported by security@huntr.devHigh 8
Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.get_file() function when extracting tar archives. The vulnerability arises because the function uses Python's tarfile.extractall() method without the security-critical filter='data' parameter. Although Keras attempts to filter unsafe paths using filter_safe_paths(), this filtering occurs before extraction, and a PATH_MAX symlink resolution bug triggers during extraction. This bug causes symlink resolution to fail due to path length limits, resulting in a security bypass that allows files to be written outside the intended extraction directory. This can lead to arbitrary file writes outside the cache directory, enabling potential system compromise or malicious code execution. The vulnerability affects Keras installations that process tar archives with get_file() and does not affect versions where this extraction method is secured with the appropriate filter parameter.
- Product
- keras-team/keras
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2025Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with lCVE-2025-59890 · Other software · Eaton · reported by CybersecurityCOE@eaton.comHigh 7.3
Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with local access to execute unauthorized code or commands. This security issue has been fixed in the latest version of Galileo which is available on the Eaton download center.
- Product
- Eaton Galileo Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2025archives is a Go library for extracting archives (tar, zip, etc.).CVE-2025-64346 · Other software · jaredallard · reported by GitHubMedium 6
archives is a Go library for extracting archives (tar, zip, etc.). Version 1.0.0 does not prevent a malicious user to feed a specially crafted archive to the library causing RCE, modification of files or other malignancies in the context of whatever the user is running this library as, through the program that imports it. Severity depends on user permissions, environment and how arbitrary archives are passed. This issue is fixed in version 1.0.1.
- Product
- archives
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2025The keras.utils.get_file API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack.CVE-2025-12060 · Other software · Keras · reported by cve-coordination@google.comHigh 8.9
The keras.utils.get_file API in Keras, when used with the extract=True option for tar archives, is vulnerable to a path traversal attack. The utility uses Python's tarfile.extractall function without the filter="data" feature. A remote attacker can craft a malicious tar archive containing special symlinks, which, when extracted, allows them to write arbitrary files to any location on the filesystem outside of the intended destination folder. This vulnerability is linked to the underlying Python tarfile weakness, identified as CVE-2025-4517. Note that upgrading Python to one of the versions that fix CVE-2025-4517 (e.g. Python 3.13.4) is not enough. One additionally needs to upgrade Keras to a version with the fix (Keras 3.12).
- Product
- Keras
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2025BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote cCVE-2025-10284 · Other software · BLSOPS, LLC · reported by cves@blacklanternsecurity.comCritical 9.6
BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote code execution.
- Product
- bbot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.blacklanternsecurity.com
Sep 22, 2025Compact Archives: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-58001 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Compact Archives compact-archives allows Stored XSS.This issue affects Compact Archives: from n/a through <= 4.1.0.
- Product
- Compact Archives
- Affected
- up to 4.1.0
- What to do
- Affects up to 4.1.0. Update Compact Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 9, 2025Halo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo_host/archives/{name}.CVE-2025-44595 · Other software · Halo · reported by MITREMedium 6.1
Halo v2.20.17 and before is vulnerable to Cross Site Scripting (XSS) in /halo_host/archives/{name}.
- Product
- Halo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmeadow-horn-b94.notion.site
Jul 25, 2025A filename spoofing vulnerability exists in WinRAR when opening specially crafted ZIP archives.CVE-2014-125119 · Other software · RARLab · reported by VulnCheckHigh 8.4
A filename spoofing vulnerability exists in WinRAR when opening specially crafted ZIP archives. The issue arises due to inconsistencies between the Central Directory and Local File Header entries in ZIP files. When viewed in WinRAR, the file name from the Central Directory is displayed to the user, while the file from the Local File Header is extracted and executed. An attacker can leverage this flaw to spoof filenames and trick users into executing malicious payloads under the guise of harmless files, potentially leading to remote code execution.
- Product
- WinRAR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordan7isec.blogspot.comraw.githubusercontent.com
Jul 11, 2025GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process.CVE-2025-45582 · Other software · GNU · reported by MITREMedium 4.1
GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official G
- Product
- Tar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.gnu.org
Jul 10, 2025An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives.CVE-2025-34097 · Other software · ProcessMaker Inc. · reported by VulnCheckHigh 8.6
An unrestricted file upload vulnerability exists in ProcessMaker versions prior to 3.5.4 due to improper handling of uploaded plugin archives. An attacker with administrative privileges can upload a malicious .tar plugin file containing arbitrary PHP code. Upon installation, the plugin’s install() method is invoked, resulting in execution of attacker-supplied PHP code on the server with the privileges of the web server user. This vulnerability can be chained with CVE-2022-38577 — a privilege escalation flaw in the user profile page — to achieve full remote code execution from a low-privileged account.
- Product
- ProcessMaker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordprocess-maker-authenticated-plugin-upload-rceraw.githubusercontent.com
Jul 7, 2025A memory corruption vulnerability exists in SAPCAR allowing an attacker to craft malicious SAPCAR archives.CVE-2025-42971 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 4
A memory corruption vulnerability exists in SAPCAR allowing an attacker to craft malicious SAPCAR archives. When a high privileged victim extracts this malicious archive, it gets processed by SAPCAR on their system, resulting in out-of-bounds memory read and write. This could lead to file extraction and file overwrite outside the intended directories. This vulnerability has low impact on the confidentiality, integrity and availability of the application.
- Product
- SAPCAR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025SAPCAR improperly sanitizes the file paths while extracting SAPCAR archives.CVE-2025-42970 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 5.8
SAPCAR improperly sanitizes the file paths while extracting SAPCAR archives. Due to this, an attacker could craft a malicious SAPCAR archive containing directory traversal sequences. When a high privileged victim extracts this malicious archive, it is then processed by SAPCAR on their system, causing files to be extracted outside the intended directory and overwriting files in arbitrary locations. This vulnerability has a high impact on the integrity and availability of the application with no impact on confidentiality.
- Product
- SAPCAR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2025Simple Nav Archives: Does not have CSRF check in placeCVE-2024-8398 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Simple Nav Archives WordPress plugin through 2.1.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
- Product
- Simple Nav Archives
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Simple Nav Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 10, 2025picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified.CVE-2025-1945 · Other software · mmaitre314 · reported by 103e4ec9-0a87-450b-af77-479448ddef11Medium 5.3
picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specific bits in the ZIP file headers, an attacker can embed malicious pickle files that remain undetected by PickleScan while still being successfully loaded by PyTorch's torch.load(). This can lead to arbitrary code execution when loading a compromised model.
- Product
- picklescan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2025picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives.CVE-2025-1944 · Other software · mmaitre314 · reported by 103e4ec9-0a87-450b-af77-479448ddef11Medium 5.3
picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives. By modifying the filename in the ZIP header while keeping the original filename in the directory listing, an attacker can make PickleScan raise a BadZipFile error. However, PyTorch's more forgiving ZIP implementation still allows the model to be loaded, enabling malicious payloads to bypass detection.
- Product
- picklescan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2025The Custom Post Type Date Archives: Arbitrary shortcode executionCVE-2025-1510 · WordPress plugins & themes · reported by WordfenceHigh 7.3
The The Custom Post Type Date Archives plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.7.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
- Product
- The Custom Post Type Date Archives
- Affected
- up to 2.7.1
- What to do
- Affects up to 2.7.1. Update The Custom Post Type Date Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordwordpress.orgwordfence.com
Jan 23, 2025Fedora Repository 3.8.1 allows path traversal when extracting uploaded archives ("Zip Slip").CVE-2025-23011 · Other software · Fedora Repository · reported by 9119a7d8-5eab-497f-8521-727c672e3725High 8.7
Fedora Repository 3.8.1 allows path traversal when extracting uploaded archives ("Zip Slip"). A remote, authenticated attacker can upload a specially crafted archive that will extract an arbitrary JSP file to a location that can be executed by an unauthenticated GET request. Fedora Repository 3.8.1 was released on 2015-06-11 and is no longer maintained. Migrate to a currently supported version (6.5.1 as of 2025-01-23).
- Product
- Fedora Repository
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2025A vulnerability, which was classified as problematic, was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532).CVE-2025-0227 · Other software · Tsinghua Unigroup · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). This affects an unknown part of the file /Logs/Annals/downLoad.html. The manipulation of the argument path leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Electronic Archives System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2025A vulnerability, which was classified as problematic, has been found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532).CVE-2025-0226 · Other software · Tsinghua Unigroup · reported by VulDBMedium 5.3
A vulnerability, which was classified as problematic, has been found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this issue is the function download of the file /collect/PortV4/downLoad.html. The manipulation of the argument path leads to information disclosure. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Electronic Archives System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 5, 2025A vulnerability classified as problematic was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532).CVE-2025-0225 · Other software · Tsinghua Unigroup · reported by VulDBMedium 5.3
A vulnerability classified as problematic was found in Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). Affected by this vulnerability is an unknown functionality of the file /setting/ClassFy/exampleDownload.html. The manipulation of the argument name leads to path traversal: '/../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
- Product
- Electronic Archives System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 30, 2024A vulnerability was found in Tsinghua Unigroup Electronic Archives Management System 3.2.210802(62532).CVE-2024-13042 · Other software · Tsinghua Unigroup · reported by VulDBMedium 5.3
A vulnerability was found in Tsinghua Unigroup Electronic Archives Management System 3.2.210802(62532). It has been classified as problematic. Affected is the function download of the file /Searchnew/Subject/download.html. The manipulation of the argument path leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
- Product
- Electronic Archives Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2024unzip-bot is a Telegram bot to extract various types of archives.CVE-2024-53992 · Other software · EDM115 · reported by GitHubHigh 8.8
unzip-bot is a Telegram bot to extract various types of archives. Users could exploit unsanitized inputs to inject malicious commands that are executed through subprocess.Popen with shell=True. Attackers can exploit this vulnerability using a crafted archive name, password, or video name. This vulnerability is fixed in 7.0.3a.
- Product
- unzip-bot
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2024Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats.CVE-2024-47877 · Other software · codeclysm · reported by GitHubMedium 6.9
Extract is aA Go library to extract archives in zip, tar.gz or tar.bz2 formats. A maliciously crafted archive may allow an attacker to create a symlink outside the extraction target directory. This vulnerability is fixed in 4.0.0. If you're using the Extractor.FS interface, then upgrading to /v4 will require to implement the new methods that have been added.
- Product
- extract
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024Collapsing Archives: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43934 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Robert Felty Collapsing Archives allows Stored XSS.This issue affects Collapsing Archives: from n/a through 3.0.5.
- Product
- Collapsing Archives
- Affected
- up to 3.0.5
- What to do
- Affects up to 3.0.5. Update Collapsing Archives to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 15, 2024Multiple functions use archives without properly validating the filenames therein, rendering the application vulnerable to path traversal via 'zip slip' attacksCVE-2023-5938 · Other software · Nozomi Networks · reported by prodsec@nozominetworks.comHigh 8.9
Multiple functions use archives without properly validating the filenames therein, rendering the application vulnerable to path traversal via 'zip slip' attacks. An administrator able to provide tampered archives to be processed by the affected versions of Arc may be able to have arbitrary files extracted to arbitrary filesystem locations. Leveraging this issue, an attacker may be able to overwrite arbitrary files on the target filesystem and cause critical impacts on the system (e.g., arbitrary command execution on the victim’s machine).
- Product
- Arc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.nozominetworks.comsecurity.nozominetworks.com
May 14, 2024Administrator Cross Site Scripting (XSS) in Archives Calendar Widget <= 1.0.15 versions.CVE-2024-33950 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Administrator Cross Site Scripting (XSS) in Archives Calendar Widget <= 1.0.15 versions.
- Affected
- up to 1.0.15
- What to do
- Affects up to 1.0.15. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Mar 13, 2024DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/archives_do.phpCVE-2024-28429 · Other software · dedecms · reported by MITREMedium 5.5
DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/archives_do.php
- Product
- dedecms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2024Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the controller, allowing atCVE-2024-28151 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comMedium 4.3
Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the controller, allowing attackers with Item/Configure permission to determine whether a path on the Jenkins controller file system exists, without being able to access it.
- Product
- Jenkins HTML Publisher Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Feb 26, 2024Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.CVE-2024-25082 · Other software · Fontforge · reported by MITREMedium 6.5
Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.
- Product
- Fontforge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comfontforge.org
Feb 6, 2024In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archivesCVE-2024-24942 · Other software · JetBrains · reported by cve@jetbrains.comMedium 5.3
In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Feb 6, 2024In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archivesCVE-2024-24940 · Other software · JetBrains · reported by cve@jetbrains.comLow 2.8
In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Jan 18, 2024Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud.CVE-2024-22404 · Other software · nextcloud · reported by GitHubMedium 4.1
Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to upgrade should disable the file zip app.
- Product
- security-advisories
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024Ursa is a cryptographic library for use with blockchains.CVE-2024-22192 · Other software · hyperledger-archives · reported by GitHubMedium 6.5
Ursa is a cryptographic library for use with blockchains. The revocation scheme that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model. Notably, a malicious verifier may be able to generate a unique identifier for a holder providing a verifiable presentation that includes a Non-Revocation proof. The impact of the flaw is that a malicious verifier may be able to determine a unique identifier for a holder presenting a Non-Revocation proof. Ursa has moved to end-of-life status and no fix is expected.
- Product
- ursa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2024Ursa is a cryptographic library for use with blockchains.CVE-2024-21670 · Other software · hyperledger-archives · reported by GitHubMedium 6.5
Ursa is a cryptographic library for use with blockchains. The revocation schema that is part of the Ursa CL-Signatures implementations has a flaw that could impact the privacy guarantees defined by the AnonCreds verifiable credential model, allowing a malicious holder of a revoked credential to generate a valid Non-Revocation Proof for that credential as part of an AnonCreds presentation. A verifier may verify a credential from a holder as being "not revoked" when in fact, the holder's credential has been revoked. Ursa has moved to end-of-life status and no fix is expected.
- Product
- ursa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/add.CVE-2023-48914 · Other software · Iteachyou · reported by MITREHigh 8.8
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/add.
- Product
- Dreamer CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/delete.CVE-2023-48913 · Other software · Iteachyou · reported by MITREHigh 8.8
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/delete.
- Product
- Dreamer CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 30, 2023Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/edit.CVE-2023-48912 · Other software · Iteachyou · reported by MITREHigh 8.8
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/edit.
- Product
- Dreamer CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 27, 2023Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessiCVE-2023-48268 · Other software · Mattermost · reported by responsibledisclosure@mattermost.comMedium 4.3
Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excessive resources, possibly leading to Denial of Service, by importing a board using a specially crafted zip (zip bomb).
- Product
- Mattermost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmattermost.commattermost.com
Jul 25, 2023Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArchiver` API.CVE-2023-37460 · Other software · codehaus-plexus · reported by GitHubHigh 8.1
Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArchiver` API. Prior to version 4.8.0, using AbstractUnArchiver for extracting an archive might lead to an arbitrary file creation and possibly remote code execution. When extracting an archive with an entry that already exists in the destination directory as a symbolic link whose target does not exist - the `resolveFile()` function will return the symlink's source instead of its target, which will pass the verification that ensures the file will not be extracted outside of the destination directory. Later `Files.newOutputStream()`, that follows symlinks by default, will actually write the entry's content to the symlink's target. Whoever uses plexus archiver to extract an untrusted archive is vulnerable to an arbitrary file creation and possibly remote code execution. Version 4.8.0 contains a patch for this issue.
- Product
- plexus-archiver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2023An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameterCVE-2023-32981 · Websites & servers · Jenkins Project · reported by jenkinsci-cert@googlegroups.comHigh 8.8
An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.
- Product
- Jenkins Pipeline Utility Steps Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect versions older than 2.2.90.CVE-2022-48310 · Network & remote access · Sophos · reported by security-alert@sophos.comMedium 5.5
An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect versions older than 2.2.90.
- Product
- Sophos Connect Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 1, 2023A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90.CVE-2022-48309 · Network & remote access · Sophos · reported by security-alert@sophos.comMedium 4.3
A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90.
- Product
- Sophos Connect Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.CVE-2020-36566 · Other software · github.com/whyrusleeping/tar-utils · reported by security@golang.orgCritical 9.1
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
- Product
- github.com/whyrusleeping/tar-utils
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.CVE-2020-36561 · Other software · github.com/yi-ge/unzip · reported by security@golang.orgCritical 9.1
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
- Product
- github.com/yi-ge/unzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.CVE-2020-36560 · Other software · github.com/artdarek/go-unzip · reported by security@golang.orgCritical 9.1
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
- Product
- github.com/artdarek/go-unzip
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.CVE-2018-25046 · Other software · code.cloudfoundry.org/archiver · reported by security@golang.orgCritical 9.1
Due to improper path sanitization, archives containing relative file paths can cause files to be written (or overwritten) outside of the target directory.
- Product
- code.cloudfoundry.org/archiver/extractor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 7, 2022Import any XML or CSV File to: Is not validating the paths of files contained in uploaded zip archivesCVE-2022-2711 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vector.
- Product
- Import any XML or CSV File to
- Fixed in
- 3.6.9
- What to do
- Update Import any XML or CSV File to to 3.6.9 or newer.
Oct 31, 2022 Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversal.CVE-2022-41772 · Other software · Delta Electronics · reported by ics-cert@hq.dhs.govCritical 9.8
Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversal. This path traversal could result in remote code execution.
- Product
- InfraSuite Device Master
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 11, 2022The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-41383 · Other software · Democritus · reported by MITRECritical 9.8
The d8s-archives package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-file-system package. The affected version is 0.1.0.
- Product
- D8s-archives
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 19, 2022The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party.CVE-2022-38881 · Other software · D8s-archives Project · reported by MITRECritical 9.8
The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
- Product
- D8s-archives
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.