CVE-2026-24909

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-23

Affected software

No affected versions have been published.

Timeline

Published
Jan 27, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-24916.3Socomec DIRIS A-40 HTTP API Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authenticatiCVE-2026-249105.9In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed by a non-npm package in the case of a matchCVE-2026-249118.6Stack-based buffer overflow for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow a denial of service.CVE-2026-249128.6The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the saCVE-2026-249138.7SQL Injection vulnerability exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, information stored in the databaCVE-2026-249145.5Type confusion vulnerability in the camera module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-249157.1Out-of-bounds read issue in the media subsystem. Impact: Successful exploitation of this vulnerability will affect availability and confidenCVE-2026-249165.5Identity authentication bypass vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service CVE-2026-249175.5UAF vulnerability in the security module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-249185.5Address read vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-249195.5Out-of-bounds write vulnerability in the DFX module. Impact: Successful exploitation of this vulnerability may affect availability.CVE-2026-24927.8TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers
CVE-2026-24909: Medium severity, CVSS 5.9 | Vulnix