CVE-2026-12565

The unarchive internal module's archive extraction commands perform no code-level validation on extracted file paths, relying entirely on the behavior of external tools (e.g. GNU tar) which varies by platform. While CVE-2025-10284 addressed git-specific RCE vectors, the underlying archive extraction path traversal was never fixed. On systems with GNU tar < 1.34 (Ubuntu 20.04, Debian Buster, CentOS 7, many Docker base images), a malicious archive can write files outside the intended extraction directory.

• CWE-22

• https://github.com/blacklanternsecurity/bbot/commit/4fb38fd6e

Published

Jun 17, 2026

Last Modified

Jun 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12547SoupAuthManager caches proxy authentication credentials with…3.4
• CVE-2026-12548A heap out-of-bounds read flaw was found in libsoup. When pa…4.2
• CVE-2026-12549The fix for CVE-2026-2443 was regressed by a subsequent rewo…4.8
• CVE-2026-12557The Ninja Forms - File Uploads plugin for WordPress is vulne…5.3
• CVE-2026-12560The Editorial Rating – Product Review & Rating System plugin…4.4
• CVE-2026-12562The RCU II+ and Multiload II+ are vulnerable to an unauthent…8.8
• CVE-2026-12566The docker_pull module uses the realm parameter from a Docke…3.1
• CVE-2026-12567The github_workflows module constructs local directory paths…2.2
• CVE-2026-12568The postman_download module uses the workspace name field fr…6.5
• CVE-2026-12569A critical remote code execution (RCE) vulnerability has bee…9.8
• CVE-2026-1257The Administrative Shortcodes plugin for WordPress is vulner…7.5
• CVE-2026-12570A vulnerability in keras-team/keras versions <= 3.15.0 allow…5.5