CVE-2026-39245
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-39245
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function (index.js line 29) and the extraction path validation (index.js line 106) use String.indexOf() to verify the resolved path is within the output directory: realDestinationDir.indexOf(realOutputPath) !== 0. This check is flawed because it does not enforce a path separator boundary. For example, "/tmp/app_config".indexOf("/tmp/app") returns 0, incorrectly passing the check even though /tmp/app_config is outside /tmp/app. Combined with the unvalidated symlink creation in the same package, an attacker can write arbitrary files to directories adjacent to the extraction target. This is a bypass of the fix for CVE-2020-12265. The correct check requires appending a path separator: realParentPath.indexOf(realOutputPath + path.sep) !== 0.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
kevva decompress 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
个人开发者 decompress是个人开发者个人开发者的一个文件解压缩工具。 kevva decompress 4.2.2之前版本存在路径遍历漏洞，该漏洞源于safeMakeDir函数和提取路径验证使用String.indexOf()未能正确执行路径分隔符边界检查，可能导致目录遍历攻击和任意文件写入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
II. Public POCs for CVE-2026-39245
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-39245
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-39245 (1)
Exploits & Public PoCs for CVE-2026-39245 (1)
Vendor Pages for CVE-2026-39245 (1)
Other References for CVE-2026-39245 (1)
Same Patch Batch · n/a · 2026-07-09 · 25 CVEs total
| CVE-2026-15187 | 4.3 MEDIUM | enquirer Public Package API Enquirer.set prototype pollution |
| CVE-2026-15202 | 4.3 MEDIUM | YzmCMS Header yzmphp.php get_url cross site scripting |
| CVE-2026-15194 | 3.3 LOW | Open5GS AMF context.c amf_context_final use after free |
| CVE-2026-15185 | 3.3 LOW | GPAC MP4Box vobsub.c vobsub_read_idx out-of-bounds |
| CVE-2026-38076 | Artifex jbig2dec 拒绝服务漏洞 | |
| CVE-2026-39246 | kevva decompress 安全漏洞 | |
| CVE-2026-39243 | kevva decompress 安全漏洞 | |
| CVE-2025-45422 | Proximus b-box 安全漏洞 | |
| CVE-2026-31267 | Mercusys MW302R 安全漏洞 | |
| CVE-2026-51923 | docuForm GmbH Client 安全漏洞 | |
| CVE-2026-51925 | docuForm GmbH Client 安全漏洞 | |
| CVE-2026-51926 | docuForm GmbH FSM Client 安全漏洞 | |
| CVE-2026-51924 | docuForm GmbH Client 任意文件上传漏洞 | |
| CVE-2025-63579 | Kyocera Command Center RX 信息泄露漏洞 | |
| CVE-2026-51602 | Tenda CP3 缓冲区错误漏洞 | |
| CVE-2026-51598 | Mercury MIPC252W IP Camera 输入验证错误漏洞 | |
| CVE-2026-51599 | MERCURY MIPC252W 安全漏洞 | |
| CVE-2026-51597 | Mercury MIPC252W 安全漏洞 | |
| CVE-2026-51603 | Tenda cp3 缓冲区错误漏洞 | |
| CVE-2026-51601 | Tenda cp3 缓冲区溢出漏洞 |
Showing top 20 of 25 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2026-39245
No comments yet