CVE-2026-50558

Severity CVSS v4.0:

Pending analysis

Type:

CWE-22 Path Traversal

Publication date:

29/07/2026

Last modified:

29/07/2026

Description

Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download() implementation in penelope.py used tar.extractall(local_download_folder) on tar archives returned by remote sessions without validating member paths, allowing a malicious or compromised session to write files outside the intended download directory and potentially overwrite ~/.penelope/peneloperc. This issue is fixed in version 0.20.0.

Impact

Vector 3.x

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L CVSS v3.1 Severity and Metrics:

Base Score: 5.90 MEDIUM
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L

Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): Required
Scope (S): Unchanged
Confidentiality (C): None
Integrity (I): High
Availability (A): Low

Base Score 3.x

5.90

Severity 3.x

MEDIUM

CVE-2026-50558

Description

Impact

References to Advisories, Solutions, and Tools