CVE-2026-24909
Medium · 5.9CVSS
5.9
EPSS
0.2%
Published
Jan 27, 2026
CISA due date
—
The record
vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @vltpkg/tar | 0 | 1.0.0-rc.10 |
Related vulnerabilities
- GHSA-gf2c-jwcj-x929 vlt Mishandles Path Sanitization for tar Same vulnerability
- CVE-2026-114714 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal… CWE-23
- CVE-2026-106552 In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files… CWE-23
- CVE-2026-89065 Relative path traversal in the generated file manifest cleanup component in projen before… CWE-23
- CVE-2026-84939 Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the… CWE-23
- CVE-2026-15913 In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles… CWE-23
- CVE-2026-87747 The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. CWE-23
- CVE-2026-67367 A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13)… CWE-23