tag
Archive-Extraction
npm `tar` Package Unicode-Normalization Race Condition / File Collision (CVE-2026-2395)
The tar npm package's parallel-extraction mode (jobs > 1) is vulnerable to a race condition rooted in Unicode normalization differences: filenames like collisionss and collisionß can be treated as the same target path due to case/normalization handling, even…
Node.js `tar` Package Symlink Path Traversal — CVE-2026-29786
The tar package's extraction engine does not sufficiently validate destination paths when an archive entry is of type symlink. An attacker can craft a tarball containing a symlink entry that points outside the intended extraction directory (e.g. to…
Docker cp Copy-Out Destination Escape via Symlink Race
docker cp copy-out operations are vulnerable to a time-of-check/time-of-use race: the daemon walks the container's source path with filepath.WalkDir and builds a tar stream, but if a container process changes a directory entry (e.g., swaps it for a symlink)…
7-Zip RAR5 Mark-of-the-Web / ADS Full-Chain Bypass
7-Zip 26.01 on Windows mishandles RAR5 archives that contain crafted STM (stream) service records alongside a normal file entry. By naming one stream ::$DATA and another :Zone.Identifier:$DATA, an attacker can make the archive-provided data silently override…
LiteSpeed User-End cPanel Plugin Local Privilege Escalation (CVE-2026-48172)
CVE-2026-48172 is a local privilege-escalation flaw in LiteSpeed cPanel Plugin v6.5.0 and earlier. The plugin installation flow does not sufficiently validate package ownership/permissions and can be abused with symlinked install targets. A normal cPanel user…