https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 11 Oct 2026 20:35:10 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-108597 <p>Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim&#39;s S3 prefix can include absolute paths or ../ members to overwrite files on the SDK host.</p> <p>Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim&#39;s S3 prefix can include absolute paths or ../ members to overwrite files on the SDK host.</p> https://db.gcve.eu/vuln/fkie_cve-2026-108597 https://db.gcve.eu/vuln/ghsa-rg44-2cq2-qx25 <p>Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim&#39;s S3 prefix can include absolute paths or ../ members to overwrite files on the SDK host.</p> <p>Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim&#39;s S3 prefix can include absolute paths or ../ members to overwrite files on the SDK host.</p> https://db.gcve.eu/vuln/ghsa-rg44-2cq2-qx25