← Back

CVE-2026-24909

nvd nist
Published: Jan 27, 2026Modified: Jun 17, 2026Deferred

JSON object

Loading...
5.9
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N
Exploitability: 1.4 / Impact: 4.0
Source: MITRE (Secondary)

Description

vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction.

Related CWEs

CWE-23
Relative Path Traversal
The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.

References (4)

Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org

Timeline

No history available yet.