5 stories, newest first · one card per story
SmartBear Collaborator 15.1 zip-slip lets a low-privilege user enable anonymous code execution.
Unauthenticated zip-slip in Auerswald COMmander 6000 firmware 8.6D yields root code execution.
FME Flow 2026.2 has a Zip-Slip flaw that can write arbitrary files and execute code as LocalSystem.
GNOME 50.5 patches gvfs CVE-2026-88924, Epiphany JavaScript injection and ZIP-slip extension flaws, plus use-after-free bugs in librsvg and GDM.
OpenCart 4.2.0.0 extension installer fails to validate zip extraction paths, allowing directory traversal (CVE-2026-18412) to write files outside intended directories.
Today 1.6K readers · 2.4K views · 775 reads · all time 189K views