The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The tarfile module's tar and data extraction filters created directories outside the destination for     members whose name leaves the destination and returns to it, such as ../evil/../dest/sub/file. The     containment check used the resolved path, but intermediate directories were created from the name as     given. Only empty directories are created outside the destination. Member contents are still extracted     inside it. To return to the destination the member's name must contain the destination directory's own     final component, so extraction into a secure randomised directory is not affected. This affects POSIX     platforms only. On Windows, .. components are collapsed before the path reaches the filesystem, so the     directories outside the destination are never created. (CVE-2026-19672)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-19672

medium Nessus Plugin ID 338288

Version 1.9

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.9 Sep 27, 2026, 3:40 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609271540
Version 1.6 Sep 12, 2026, 3:33 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609120333
Version 1.5 Sep 11, 2026, 9:51 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609112151
Version 1.4 Sep 2, 2026, 6:07 PM Detection (updated detection logic) Plugin metadata Plugin Feed: 202609021807
Version 1.3 Aug 27, 2026, 3:41 PM CVSS metrics ("CVSSv3 score" set to 5.2) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N") CVSSv3 severity (based on None, severity increased from "Low" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608271541
Version 1.2 Aug 22, 2026, 9:26 PM CVSS metrics ("CVSSv2 score" set to 3.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:N") CVSS metrics ("CVSSv3 score" set to 3.3) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N") CVSSv2 severity (based on CVE-2026-19672, severity decreased from "High" to "Low") CVSSv3 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202608222126
Version 1.1 Aug 20, 2026, 2:44 PM New Plugin Feed: 202608201444