THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-f42x-p2mx-hm8r (medium) — Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

[GHSA] GHSA-f42x-p2mx-hm8r (medium) — Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

medgithub_advisoriesPublished 2026-07-29

GHSA-f42x-p2mx-hm8r Severity: medium CVE: CVE-2026-50558

Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

### Summary

Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafte

Indicators of compromise

CVE-2026-50558cve

Original source: https://github.com/advisories/GHSA-f42x-p2mx-hm8r