CVE-2026-50558 Details
Description
Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download() implementation in penelope.py used tar.extractall(local_download_folder) on tar archives returned by remote sessions without validating member paths, allowing a malicious or compromised session to write files outside the intended download directory and potentially overwrite ~/.penelope/peneloperc. This issue is fixed in version 0.20.0.
A path traversal vulnerability has been identified in Penelope Shell Handler versions prior to 0.20.0. The issue arises in the Unix download implementation, where tar archives received from remote sessions are extracted without proper validation of member paths. This flaw allows a malicious or compromised session to craft a tar archive that writes files outside the designated download directory, potentially overwriting important configuration files such as ~/.penelope/peneloperc. The vulnerability could lead to unauthorized code execution if a file executed by Penelope is replaced with a malicious version.
Users should update to Penelope version 0.20.0 or later, where this vulnerability has been fixed by implementing proper path validation during tar extraction.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 29, 2026CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/brightio/penelope/commit/a040afb5db32c7e80b5e8a2f9b2164cf911cfa62 | [email protected] | Source CodeVendor |
| https://github.com/brightio/penelope/releases/tag/v0.20.0 | [email protected] | Release NotesVendor |
| https://github.com/brightio/penelope/security/advisories/GHSA-f42x-p2mx-hm8r | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| BrightIO Penelope | < 0.19.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 29, 2026 | New CVE Received | [email protected] |