jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `jaraco.context.tarball()` function starting in version 5.2.0 and prior to version 6.1.0. The vulnerability may allow attackers to extract files outside the intended extraction directory when malicious tar archives are processed. The strip_first_component filter splits the path on the first `/` and extracts the second component, while allowing `../` sequences. Paths like `dummy_dir/../../etc/passwd` become `../../etc/passwd`. Note that this suffers from a nested tarball attack as well with multi-level tar files such as `dummy_dir/inner.tar.gz`, where the inner.tar.gz includes a traversal `dummy_dir/../../config/.env` that also gets translated to `../../config/.env`. Version 6.1.0 contains a patch for the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - jaraco.context, an open-source software package that provides some useful decorators and context managers,
    has a Zip Slip path traversal vulnerability in the `jaraco.context.tarball()` function starting in version
    5.2.0 and prior to version 6.1.0. The vulnerability may allow attackers to extract files outside the
    intended extraction directory when malicious tar archives are processed. The strip_first_component filter
    splits the path on the first `/` and extracts the second component, while allowing `../` sequences. Paths
    like `dummy_dir/../../etc/passwd` become `../../etc/passwd`. Note that this suffers from a nested tarball
    attack as well with multi-level tar files such as `dummy_dir/inner.tar.gz`, where the inner.tar.gz
    includes a traversal `dummy_dir/../../config/.env` that also gets translated to `../../config/.env`.
    Version 6.1.0 contains a patch for the issue. (CVE-2026-23949)

The remote Ubuntu 25.10 host has a package installed that is affected by a vulnerability as referenced in the USN-7979-1 advisory.

    It was discovered that jaraco.context incorrectly handled certain zip file paths. An attacker could     possibly use this issue to extract arbitrary files outside of the intented extraction directory.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:20139-1 advisory.

    - CVE-2026-23949: Fixed malicious tar archives may lead to path traversal (bsc#1256954).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:20095-1 advisory.

    - CVE-2026-23949: Fixed malicious tar archives may lead to path traversal (bsc#1256954).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jaraco.context, an open-source software package that provides some useful decorators and context managers,     has a Zip Slip path traversal vulnerability in the `jaraco.context.tarball()` function starting in version     5.2.0 and prior to version 6.1.0. The vulnerability may allow attackers to extract files outside the     intended extraction directory when malicious tar archives are processed. The strip_first_component filter     splits the path on the first `/` and extracts the second component, while allowing `../` sequences. Paths     like `dummy_dir/../../etc/passwd` become `../../etc/passwd`. Note that this suffers from a nested tarball     attack as well with multi-level tar files such as `dummy_dir/inner.tar.gz`, where the inner.tar.gz     includes a traversal `dummy_dir/../../config/.env` that also gets translated to `../../config/.env`.
    Version 6.1.0 contains a patch for the issue. (CVE-2026-23949)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
465726	Echo: jaraco-context: security update to 5.3.0+echo.1jaraco.context: security update to 6.0.1-1+e1python-3.11: security update to 3.11.16+e2	Tenable Cloud Security	Echo Local Security Checks	Local	high
465726	Echo: jaraco-context: security update to 5.3.0+echo.1jaraco.context: security update to 6.0.1-1+e1python-3.11: security update to 3.11.16+e2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
297275	Ubuntu 25.10 : jaraco.context vulnerability (USN-7979-1)	Nessus	Ubuntu Local Security Checks	Local	high
297084	SUSE SLES16 Security Update : python-jaraco.context (SUSE-SU-2026:20139-1)	Nessus	SuSE Local Security Checks	Local	high
296557	openSUSE 16 Security Update : python-jaraco.context (openSUSE-SU-2026:20095-1)	Nessus	SuSE Local Security Checks	Local	high
293775	Linux Distros Unpatched Vulnerability : CVE-2026-23949	Nessus	Misc.	Local	high
436739	SCA: security update for jaraco.context (GHSA-58pv-8j8x-9vj2)	Tenable Cloud Security	SCA Checks	Local	high
436739	SCA: security update for jaraco.context (GHSA-58pv-8j8x-9vj2)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-23949

high

Tenable Plugins

high

high

high

high

high

high

high

high