PT-2026-3523 · Unknown+1 · Jaraco.Context+1

Tsigouris007 · Published 2026-01-13 · Updated 2026-05-21 · CVE-2026-23949

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions jaraco.context versions prior to 6.1.0

Description jaraco.context, a software package providing decorators and context managers, contains a path traversal issue in the jaraco.context.tarball() function. The issue allows attackers to extract files outside the intended directory when processing malicious tar archives. The vulnerability arises because the strip first component filter incorrectly handles ../ sequences within paths, enabling traversal attacks. This is also susceptible to nested tarball attacks involving multi-level tar files. The tarball() function is vulnerable.

Recommendations Update jaraco.context to version 6.1.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-03594

CVE-2026-23949

ECHO-4DEA-2475-6D75

GHSA-58PV-8J8X-9VJ2

OPENSUSE-SU-2026:10077-1

OPENSUSE-SU-2026:20095-1

SUSE-SU-2026:20139-1

USN-7979-1

Affected Products

Red Os

Jaraco.Context

References · 37

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23949.json · Exploit
• https://github.com/pypa/setuptools/blob/main/setuptools/_vendor/jaraco/context.py#L55-L76 · Patch
• https://github.com/jaraco/jaraco.context/security/advisories/GHSA-58pv-8j8x-9vj2 · Vendor Advisory
• https://github.com/jaraco/jaraco.context/blob/main/jaraco/context/__init__.py#L74-L91 · Patch
• https://github.com/jaraco/jaraco.context/commit/7b26a42b525735e4085d2e994e13802ea339d5f9 · Patch
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-23949 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23949 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23949 · Security Note
• https://osv.dev/vulnerability/GHSA-58pv-8j8x-9vj2 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-03594 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23949 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20139-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23949 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23949 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23949 · Security Note