Directory traversal vulnerability in the (1) extract and (2) extractall functions in the tarfile module in Python allows user-assisted remote attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames in a TAR archive, a related issue to CVE-2001-1267.
PoC: tarpioka
YISF 2024 CTF-Web Directory (Traversal via ".tar" file, CVE-2007-4559), easy
PoC: trellix-tarslip-patch-bypass
Bypass for CVE-2007-4559 Trellix patch
PoC: MALW
CVE-2007-4559 - Polemarch exploit
PoC: Creosote
Creosote is our solution to searching for the tarfile vulnerability described by CVE-2007-4559.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free