Summary
It was discovered that jaraco.context incorrectly handled certain zip file
paths. An attacker could possibly use this issue to extract arbitrary files
outside of the intented extraction directory.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 25.10 | jaraco.context | 6.0.1-1ubuntu0.1 |
Vulnerabilities 1
-
High 8.6
jaraco.context Has a Path Traversal Vulnerability
jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `jaraco.context.tarball()` function starting in version 5.2.0 and prior to version 6.1.0. The vulnera…
References
-
report
https://ubuntu.com/security/CVE-2026-23949