brightio vulnerabilities

Products

• penelope 1

Latest brightio CVEs

Newest publication first

1. CVE-2026-50558 Penelope unsafe tar extraction allows arbitrary local file write via crafted session archive

   Published 2026-07-29

   Medium·CVSS 5.9 EPSS 0.37%

   Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download() implementation in penelope.py used tar.extractall(local_download_folder) on tar archives returned by remote sessions without validating member paths,...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.