CVE-2026-12565

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The unarchive internal module's archive extraction commands lack code-level validation for extracted file paths. This causes the module to rely on the behavior of external tools, such as GNU tar, which varies across platforms. This path traversal issue allows a malicious archive to write files outside the intended extraction directory on systems using GNU tar versions prior to 1.34.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.