Zip Slip, Path Traversal Vulnerability during File Decompression - ASEC

Zip Path Traversal  |  Security  |  Android Developers

The Zip Path Traversal vulnerability, also known as ZipSlip, is related to handling compressed archives. On this page, we demonstrate this vulnerability using the ZIP format as an example, but similar problems can arise in libraries handling other formats, like TAR, RAR, or 7z.

Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)

### Summary A path traversal vulnerability in pnpm's binary fetcher allows malicious packages to write files outside the intended extraction directory. The vulnerability has two attack vecto...

Secure coding technique: Default behavior of Zip libraries can lead to Remote Code Execution - Blog

This week we are going to talk about the default behavior of Zip libraries. If you are an application developer, it is very likely that you have used this before. Most resources that are downloaded over the internet are in zip format, this makes sense; compressed data is smaller, so it downloads faster and consumes less bandwidth.

How to Prevent Zip File Exploitation | CrowdStrike

This blog post explores how the zip file format can be exploited and shares the solution the CrowdStrike team came up with.

sxyazi/yazi

💥 Blazing fast terminal file manager written in Rust, based on async I/O.

Linux distributions worldwide targeted by the Copy Fail exploit

An exploit for the "Copy Fail" security vulnerability (CVE-2026-31431) in the Linux kernel has been made public. The vulnerability affects all major Linux

GitHub RCE Vulnerability: CVE-2026-3854 Breakdown | Wiz Blog

A CVSS 8.7 vulnerability in GitHub Enterprise Server allows remote code execution. Read the threat brief and find vulnerable GHES instances from Wiz.

Strata — inside the archive

“Implementation Selection” in Rust — Andrew Lilley Brinker

Exploring options for selecting branching paths in Rust code at compile time and runtime.

Tiles: take a blob's mimeType from what uploadBlob returns #11

The tiles appendix recommends `application/octet-stream` as the `mimeType` of every blob reference. On some PDS implementations that recommendation makes a tile unpublishable as soon as it contains a file whose type can be recognised from its bytes. The reference implementation (bluesky-social/atproto, packages/pds, actor-`store/blob/transactor.ts`) does two things that together cause it: - On `com.atproto.repo.uploadBlob` it sniffs the bytes and stores the blob under the type it recognises (`image/png`, `audio/wav`, `font/woff2`, ...). The type the upload declared is used only when nothing is recognised, which is the case for HTML, CSS, JavaScript and JSON. - When a record that references a newly uploaded blob is written, it compares the reference's `mimeType` with the stored type and refuses the whole write if they differ: "Referenced Mimetype does not match stored blob. Expected: image/png". So a publisher that follows the appendix and writes `application/octet-stream` everywhere succeeds for a tile made only of text, and fails at the `com.atproto.repo.putRecord` of the tile's record for any tile with an image, a sound or a font in it. appmosphe.re's publish page does exactly this and fails that way, for example with "Expected: audio/wav" for a tile carrying a WAV sample. `atile publish` does not fail, because it sniffs each file itself with the same file-type library and writes what it finds; that only works as long as its sniffing agrees with that of the implementation it publishes to. `uploadBlob` already answers with the complete blob reference, `mimeType` included. Using that reference as the resource's src is correct on every implementation: one that sniffs reports the type it stored, and one that does not reports the declared `application/octet-stream`, which is what the appendix recommended before. The content-type the tile is served with stays separate and unaffected.

Tree Borrows | Proceedings of the ACM on Programming Languages

The Rust programming language is well known for its ownership-based type system, which offers strong guarantees like memory safety and data race freedom. However, Rust also provides unsafe escape hatches, for which safety is not guaranteed automatically ...

zzstoatzz.io/semble

A repository on Tangled

zzstoatzz.io/semble

A repository on Tangled

Deterministic Core, Non-Deterministic Shell - Outdata

Determinism, architecture, and the de-sloppification of legacy code.

Ollama Out-of-Bounds Read Vulnerability Allows Remote Process Memory Leak

Critical out-of-bounds read in Ollama before 0.17.1 leaks process memory including API keys from over 300000 servers via crafted GGUF files.