deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-13742
Published: 2025-11-27
Description: Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final email. If the name of the attendee contained HTML or Markdown formatting, this was rendered as HTML in the resulting email. This way, a user could inject links or other formatted text through a maliciously formatted name. Since pretix applies a strict allow list approach to allowed HTML tags, this could not be abused for XSS or similarly dangerous attack chains. However, it can be used to manipulate emails in a way that makes user-provided content appear in a trustworthy and credible way, which can be abused for phishing.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-116
References: https://pretix.eu/about/en/blog/20251126-release-2025-9-1/
CVE: CVE-2025-59890
Published: 2025-11-27
Description: Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with local access to execute unauthorized code or commands. This security issue has been fixed in the latest version of Galileo which is available on the Eaton download center.
CVSS Score: 7.3 (HIGH)
CWE: CWE-22
References: https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2025-1024.pdf
CVE: CVE-2025-54057
Published: 2025-11-27
Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking.

This issue affects Apache SkyWalking: <= 10.2.0.

Users are recommended to upgrade to version 10.3.0, which fixes the issue.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80
References: https://lists.apache.org/thread/sl2x2tx8y007x0mo746yddx2lvnv9tcr; http://www.openwall.com/lists/oss-security/2025/11/27/1; http://www.openwall.com/lists/oss-security/2026/04/13/3
CVE: CVE-2025-59302
Published: 2025-11-27
Description: In  Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admins.

  *  quotaTariffCreate
  *  quotaTariffUpdate
  *  createSecondaryStorageSelector
  *  updateSecondaryStorageSelector
  *  updateHost
  *  updateStorage


This issue affects Apache CloudStack: from 4.18.0 before 4.20.2, from 4.21.0 before 4.22.0. Users are recommended to upgrade to versions 4.20.2 or 4.22.0, which contain the fix.

The fix introduces a new global configuration flag, js.interpretation.enabled, allowing administrators to control the interpretation of JavaScript expressions in these APIs, thereby mitigating the code injection risk.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-94, CWE-94
References: https://lists.apache.org/thread/kwwsg2j85f1b75o0ht5zbr34d7h66788; http://www.openwall.com/lists/oss-security/2025/11/27/2
CVE: CVE-2025-59454
Published: 2025-11-27
Description: In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL
- listNetworkACLs
- listResourceDetails
- listVirtualMachinesUsageHistory
- listVolumesUsageHistory

While these APIs were accessible only to authorized users, insufficient permission validation meant that users could occasionally access information beyond their intended scope.




Users are recommended to upgrade to Apache CloudStack 4.20.2.0 or 4.22.0.0, which fixes the issue.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://lists.apache.org/thread/0hlklvlwhzsfw39nocmyxb6svjbs9xbc; http://www.openwall.com/lists/oss-security/2025/11/27/3
CVE: CVE-2025-12971
Published: 2025-11-27
Description: The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'wcp_change_post_folder' function in all versions up to, and including, 3.1.5. This makes it possible for authenticated attackers, with Contributor-level access and above, to move arbitrary folder contents to arbitrary folders.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863
References: https://plugins.trac.wordpress.org/browser/folders/trunk/includes/folders.class.php#L3291; https://plugins.trac.wordpress.org/changeset/3402986/; https://research.cleantalk.org/cve-2025-12971/
CVE: CVE-2025-12140
Published: 2025-11-27
Description: The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. The application interprets the entered string of characters as a Java expression, allowing an unauthenticated attacer to perform arbitrary code execution.
This issue was fixed in version wu#2016.1.5513#0#20251014_113353
CWE: CWE-95
References: https://cert.pl/posts/2025/11/CVE-2025-12140/
CVE: CVE-2025-13692
Published: 2025-11-27
Description: The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. A form with a file upload field must be created with the premium version of the plugin in order to exploit the vulnerability. However, once the form exists, the vulnerability is exploitable even if the premium version is deactivated and/or uninstalled.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_filters_process.class.php#L3279; https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_form.class.php#L1952; https://plugins.trac.wordpress.org/browser/unlimited-elements-for-elementor/trunk/inc_php/unitecreator_form.class.php#L1960
CVE: CVE-2025-8890
Published: 2025-11-27
Description: Firmware in SDMC NE6037 routers prior to version 7.1.12.2.44 has a network diagnostics tool vulnerable to a shell command injection attacks.
In order to exploit this vulnerability, an attacker has to log in to the router's administrative portal, which by default is reachable only via LAN ports.
CWE: CWE-78
References: https://cert.pl/en/posts/2025/11/CVE-2025-8890; https://www.securitum.com/cve-2025-8890.html; https://www.securitum.com/cve-2025-8890.html
CVE: CVE-2025-12419
Published: 2025-11-27
Description: Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Connect authentication which allows an authenticated attacker with team creation privileges to take over a user account via manipulation of authentication data during the OAuth completion flow. This requires email verification to be disabled (default: disabled), OAuth/OpenID Connect to be enabled, and the attacker to control two users in the SSO system with one of them never having logged into Mattermost.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-303
References: https://mattermost.com/security-updates
CVE: CVE-2025-13757
Published: 2025-11-27
Description: SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.3.8.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89, CWE-89
References: https://devolutions.net/security/advisories/DEVO-2025-0018/
CVE: CVE-2025-13758
Published: 2025-11-27
Description: Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8.
CVSS Score: 3.5 (LOW)
CWE: CWE-200, CWE-522
References: https://devolutions.net/security/advisories/DEVO-2025-0018/
CVE: CVE-2025-13765
Published: 2025-11-27
Description: Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: before 2025.2.21, before 2025.3.9.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://devolutions.net/security/advisories/DEVO-2025-0018/
CVE: CVE-2025-12559
Published: 2025-11-27
Description: Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to sanitize team email addresses to be visible only to Team Admins, which allows any authenticated user to view team email addresses via the GET /api/v4/channels/{channel_id}/common_teams endpoint
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://mattermost.com/security-updates
CVE: CVE-2025-12421
Published: 2025-11-27
Description: Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange originates from the same authentication flow, which allows an authenticated user to perform account takeover via a specially crafted email address used when switching authentication methods and sending a request to the /users/login/sso/code-exchange endpoint. The vulnerability requires ExperimentalEnableAuthenticationTransfer to be enabled (default: enabled) and RequireEmailVerification to be disabled (default: disabled).
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-303
References: https://mattermost.com/security-updates
CVE: CVE-2025-3261
Published: 2025-11-27
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-13338
Published: 2025-11-27
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2025-66359
Published: 2025-11-28
Description: An issue was discovered in Logpoint before 7.7.0. Insufficient input validation and a lack of output escaping in multiple components leads to a cross-site scripting (XSS) vulnerability.
CVSS Score: 8.5 (HIGH)
CWE: CWE-79
References: https://servicedesk.logpoint.com/hc/en-us/articles/[PII_REDACTED]8333-XSS-Vulnerability-due-to-insufficient-input-validation
CVE: CVE-2025-66360
Published: 2025-11-28
Description: An issue was discovered in Logpoint before 7.7.0. An improperly configured access control policy exposes sensitive Logpoint internal service (Redis) information to li-admin users. This can lead to privilege escalation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: https://servicedesk.logpoint.com/hc/en-us/articles/[PII_REDACTED]7549-Redis-communication-exposed-for-internal-communication
CVE: CVE-2025-66361
Published: 2025-11-28
Description: An issue was discovered in Logpoint before 7.7.0. Sensitive information is exposed in System Processes for an extended period during high CPU load.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-1336
References: https://servicedesk.logpoint.com/hc/en-us/articles/[PII_REDACTED]6749-Process-Data-Exposure-Under-High-Load
CVE: CVE-2025-58294
Published: 2025-11-28
Description: Permission control vulnerability in the print module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2025/11/
CVE: CVE-2025-58303
Published: 2025-11-28
Description: UAF vulnerability in the screen recording framework module.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 8.4 (HIGH)
CWE: CWE-362, CWE-416
References: https://consumer.huawei.com/en/support/bulletin/2025/11/
CVE: CVE-2025-58307
Published: 2025-11-28
Description: UAF vulnerability in the screen recording framework module.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-416
References: https://consumer.huawei.com/en/support/bulletin/2025/11/
CVE: CVE-2025-58309
Published: 2025-11-28
Description: Permission control vulnerability in the startup recovery module.
Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2025/11/
CVE: CVE-2025-58310
Published: 2025-11-28
Description: Permission control vulnerability in the distributed component.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 8.0 (HIGH)
CWE: CWE-843
References: https://consumer.huawei.com/en/support/bulletin/2025/11/
CVE: CVE-2025-58312
Published: 2025-11-28
Description: Permission control vulnerability in the App Lock module.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2025/11/
CVE: CVE-2025-58314
Published: 2025-11-28
Description: Vulnerability of accessing invalid memory in the component driver module.
Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-125
References: https://consumer.huawei.com/en/support/bulletin/2025/11/
CVE: CVE-2025-58315
Published: 2025-11-28
Description: Permission control vulnerability in the Wi-Fi module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2025/11/
CVE: CVE-2025-58316
Published: 2025-11-28
Description: DoS vulnerability in the video-related system service module.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 7.3 (HIGH)
CWE: CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2025/11/
CVE: CVE-2025-64311
Published: 2025-11-28
Description: Permission control vulnerability in the Notepad module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2025/11/
CVE: CVE-2025-64313
Published: 2025-11-28
Description: Denial of service (DoS) vulnerability in the office service.
Impact: Successful exploitation of this vulnerability may affect availability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-362
References: https://consumer.huawei.com/en/support/bulletin/2025/11/
CVE: CVE-2025-64314
Published: 2025-11-28
Description: Permission control vulnerability in the memory management module.
Impact: Successful exploitation of this vulnerability may affect confidentiality.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-843
References: https://consumer.huawei.com/cn/support/bulletinlaptops/2025/11/
CVE: CVE-2025-64315
Published: 2025-11-28
Description: Configuration defect vulnerability in the file management module.
Impact: Successful exploitation of this vulnerability may affect app data confidentiality and integrity.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: https://consumer.huawei.com/cn/support/bulletinlaptops/2025/11/
CVE: CVE-2025-13737
Published: 2025-11-28
Description: The Nextend Social Login and Register plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.21. This is due to missing or incorrect nonce validation on the 'unlinkUser' function. This makes it possible for unauthenticated attackers to unlink the user's social login via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/nextend-facebook-connect/tags/3.1.21/includes/provider.php#L772; https://plugins.trac.wordpress.org/changeset/3404174/nextend-facebook-connect/trunk/includes/provider.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/9c6b747e-d267-4fd3-a4fd-022aa657c796?source=cve
CVE: CVE-2025-58302
Published: 2025-11-28
Description: Permission control vulnerability in the Settings module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 8.4 (HIGH)
CWE: CWE-264
References: https://consumer.huawei.com/en/support/bulletin/2025/11/
CVE: CVE-2025-58304
Published: 2025-11-28
Description: Permission control vulnerability in the file management module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-199
References: https://consumer.huawei.com/en/support/bulletin/2025/11/
CVE: CVE-2025-58305
Published: 2025-11-28
Description: Identity authentication bypass vulnerability in the Gallery app.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2025/11/
CVE: CVE-2025-58308
Published: 2025-11-28
Description: Vulnerability of improper criterion security check in the call module.
Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.
CVSS Score: 7.3 (HIGH)
CWE: CWE-358
References: https://consumer.huawei.com/en/support/bulletin/2025/11/
CVE: CVE-2025-58311
Published: 2025-11-28
Description: UAF vulnerability in the USB driver module.
Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-416
References: https://consumer.huawei.com/en/support/bulletin/2025/11/
CVE: CVE-2025-64312
Published: 2025-11-28
Description: Permission control vulnerability in the file management module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-200
References: https://consumer.huawei.com/en/support/bulletin/2025/11/
CVE: CVE-2025-66370
Published: 2025-11-28
Description: Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the server's filesystem.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-611
References: https://blog.kivitendo.de/?p=1415; https://github.com/kivitendo/kivitendo-erp/blob/fd3f993fc731cbcaa5eb87d55df7c82df4df9c09/doc/changelog; https://github.com/kivitendo/kivitendo-erp/commit/1286dee72f[PII_REDACTED]d0cdb5f52f13b0f7d4de
CVE: CVE-2025-66371
Published: 2025-11-28
Description: Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the filesystem and expose their content to a remote host.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-611
References: https://github.com/iterasdev/peppol-py/commit/349a4bff8adb6205ea411bac8d7a06da0477abd7; https://github.com/iterasdev/peppol-py/pull/16; https://github.com/iterasdev/peppol-py/releases/tag/1.1.1
CVE: CVE-2025-66372
Published: 2025-11-28
Description: Mustang before 2.16.3 allows exfiltrating files via XXE attacks.
CVSS Score: 2.8 (LOW)
CWE: CWE-611
References: https://github.com/ZUGFeRD/mustangproject/issues/685; https://github.com/ZUGFeRD/mustangproject/pull/725; https://github.com/ZUGFeRD/mustangproject/releases/tag/core-2.16.3
CVE: CVE-2025-66382
Published: 2025-11-28
Description: In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.
CVSS Score: 2.9 (LOW)
CWE: CWE-407
References: https://github.com/libexpat/libexpat/issues/1076; http://www.openwall.com/lists/oss-security/2025/12/02/1
CVE: CVE-2025-66384
Published: 2025-11-28
Description: app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmp_name.
CVSS Score: 8.2 (HIGH)
CWE: CWE-684
References: https://github.com/MISP/MISP/compare/v2.5.23...v2.5.24; https://github.com/misp/misp/commit/6867f0d3157a1959154bdad9ddac009dec6a19f5
CVE: CVE-2025-66385
Published: 2025-11-28
Description: UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as admin) via the user-edit endpoint by supplying or modifying role_id or organisation_id fields in the edit request.
CWE: CWE-472
References: https://github.com/cerebrate-project/cerebrate/commit/c9bfa90abc85d4a20a9cc2f282959b72bef829bb; https://github.com/cerebrate-project/cerebrate/compare/v1.29...v1.30; https://vulnerability.circl.lu/api/vulnerability/gcve-1-2025-0017
CVE: CVE-2025-66386
Published: 2025-11-28
Description: app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-23
References: https://github.com/MISP/MISP/commit/7f4a0386d38672eddc139f5735d71c3b749623ce; https://github.com/MISP/MISP/compare/v2.5.26...v2.5.27
CVE: CVE-2025-13768
Published: 2025-11-28
Description: WebITR developed by Uniong has an Authentication Bypass vulnerability, allowing authenticated remote attackers to log into the system as any user by modifying a specific parameter. Attackers must first obtain a user ID to exploit this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-639
References: https://www.twcert.org.tw/en/cp-139-10539-21f45-2.html; https://www.twcert.org.tw/tw/cp-132-10538-6a26d-1.html
CVE: CVE-2025-13769
Published: 2025-11-28
Description: WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.twcert.org.tw/en/cp-139-10539-21f45-2.html; https://www.twcert.org.tw/tw/cp-132-10538-6a26d-1.html
CVE: CVE-2025-13770
Published: 2025-11-28
Description: WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: https://www.twcert.org.tw/en/cp-139-10539-21f45-2.html; https://www.twcert.org.tw/tw/cp-132-10538-6a26d-1.html
CVE: CVE-2025-13771
Published: 2025-11-28
Description: WebITR developed by Uniong has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-23
References: https://www.twcert.org.tw/en/cp-139-10539-21f45-2.html; https://www.twcert.org.tw/tw/cp-132-10538-6a26d-1.html
CVE: CVE-2025-12143
Published: 2025-11-28
Description: Stack-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-121
References: https://search.abb.com/library/Download.aspx?DocumentID=9AKK108471A8107&LanguageCode=en&DocumentPartId=&Action=Launch
CVE: CVE-2025-11156
Published: 2025-11-28
Description: Netskope was notified about a potential gap in its agent (NS Client) on Windows systems.  If this gap is successfully exploited, a local, authenticated user with Administrator privileges can improperly load the driver as a generic kernel service. This triggers the flaw, causing a system crash (Blue-Screen-of-Death) and resulting in a Denial of Service (DoS) for the affected machine.
CWE: CWE-476
References: https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2025-005
CVE: CVE-2025-12638
Published: 2025-11-28
Description: Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.get_file() function when extracting tar archives. The vulnerability arises because the function uses Python's tarfile.extractall() method without the security-critical filter='data' parameter. Although Keras attempts to filter unsafe paths using filter_safe_paths(), this filtering occurs before extraction, and a PATH_MAX symlink resolution bug triggers during extraction. This bug causes symlink resolution to fail due to path length limits, resulting in a security bypass that allows files to be written outside the intended extraction directory. This can lead to arbitrary file writes outside the cache directory, enabling potential system compromise or malicious code execution. The vulnerability affects Keras installations that process tar archives with get_file() and does not affect versions where this extraction method is secured with the appropriate filter parameter.
CVSS Score: 8.0 (HIGH)
CWE: CWE-22
References: https://huntr.com/bounties/f94f5beb-54d8-4e6a-8bac-86d9aee103f4