PT-2026-65830 · Penelope · Penelope

CVE-2026-50558 · Published 2026-07-29 · Updated 2026-07-29

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Penelope versions prior to 0.20.0

Description The Unix download() implementation in penelope.py fails to validate member paths when extracting tar archives received from remote sessions. A malicious or compromised session can return a crafted tar archive containing path traversal entries (e.g., ../), allowing the attacker to write arbitrary files outside the intended download directory on the operator's machine. This is possible because the software uses tar.extractall(local download folder) without verifying if the destination paths remain within the local download folder variable. This issue can be chained to achieve code execution on the operator's machine if the attacker overwrites a file that is later executed, such as ~/.penelope/peneloperc.

Recommendations Update Penelope to version 0.20.0 or later. As a temporary workaround, avoid using the download command to retrieve files from untrusted or compromised remote sessions.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-50558

GHSA-F42X-P2MX-HM8R

Affected Products

Penelope

References · 6

• 🔥 https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r · Exploit
• https://osv.dev/vulnerability/GHSA-f42x-p2mx-hm8r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-50558 · Security Note
• https://github.com/brightio/penelope/releases/tag/v0.20.0 · Note
• https://github.com/brightio/penelope/commit/a040afb5db32c7e80b5e8a2f9b2164cf911cfa62 · Note
• https://github.com/brightio/penelope · Note