PT-2026-5031 · Vlt · Vlt

Published 2026-01-27 · Updated 2026-01-28 · CVE-2026-24909

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions vlt versions prior to 1.0.0-rc.10

Description The software does not properly sanitize paths when extracting tar archives, which can allow for path traversal. This means a malicious tar archive could be crafted to write files outside of the intended destination directory.

Recommendations Update to version 1.0.0-rc.10 or later.

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2026-24909

GHSA-GF2C-JWCJ-X929

Affected Products

Vlt

References · 10

• https://osv.dev/vulnerability/CVE-2026-24909 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gf2c-jwcj-x929 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24909 · Security Note
• https://github.com/vltpkg/vltpkg · Note
• https://github.com/vltpkg/vltpkg/commit/ff8d4099a1929772cea2adf131285e90ede6b0dd · Note
• https://github.com/vltpkg/vltpkg/releases/tag/v1.0.0-rc.10 · Note
• https://github.com/vltpkg/vltpkg/pull/1334 · Note
• https://t.me/cveNotify/150052 · Telegram Post
• https://koi.ai/blog/packagegate-6-zero-days-in-js-package-managers-but-npm-wont-act · Note
• https://scworld.com/news/six-javascript-zero-day-bugs-lead-to-fears-of-supply-chain-attack · Note