CVE-2026-24909 Details

A path traversal vulnerability has been identified in vlt versions prior to 1.0.0-rc.10. The issue arises from improper path sanitization when extracting tar files, which can be exploited to write files anywhere on the filesystem. This includes overwriting critical files, such as the user's git binary. The vulnerability is triggered by crafting a tarball that exploits the regex validation, allowing `../` sequences to bypass restrictions and access sensitive areas of the file system.

Users can update to vlt version 1.0.0-rc.10 or later, where this vulnerability has been fixed.