Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: wummel Clear all filters
TI-2026-69114 CVE-2026-106057 · GHSA-73h5-w67h-9rfh

OS command injection in patool on Windows via archive filenames

Priority MEDIUM 40

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shell_quote_nt fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames.

CVSS 4.0HIGH 8.5 Local No auth User interaction EPSS 0.00749 Published 2026-10-07 Fixed in 4.0.6 CWE-78
TI-2026-23327 CVE-2026-29509 · GHSA-p95f-9f9h-wwvh

Patool < 4.0.5 Path Traversal via safe_extract() Function

Priority LOW 24

Patool before 4.0.5 contains a path traversal vulnerability in the safe_extract() function in patoolib/programs/py_tarfile.py when running on Python before 3.12, where the is_within_directory() helper uses os.path.common…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00371 Published 2026-06-26 Fixed in 4.0.5 CWE-22