CVE-2026-65921: A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location.

highCVSS 8.8CVE-2026-65921

A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location.

Details

Source: NVD Recent CVEs (US · database · site)
Severity: high — CVSS 8.8
Published: 2026-07-27
Last updated: 2026-07-30
Exploitation: Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-65921

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-659210.37% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-65921	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownNCSC-2026-0272 [1.00] [M/H] Kwetsbaarheden verholpen in JFrog Artifactoryncsc-nl
high[NEW] [high] JFrog Artifactory: Multiple vulnerabilitiescert-bund

Recent advisories for A path validation

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-67295: FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirect…nvd · 2026-08-01
unknownCVE-2026-53502: Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, file_loader de…nvd · 2026-07-31
mediumCVE-2026-64816: RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to…nvd · 2026-07-30
unknownCVE-2026-67247: A path traversal vulnerability was found in the IHM Log handling of ADM. The vulnerability occ…nvd · 2026-07-30
unknownCVE-2026-67246: A path traversal vulnerability was found in the Wallpaper component of ADM. The vulnerability …nvd · 2026-07-30
unknownCVE-2026-67245: A path traversal vulnerability was found in the VPN Clients on the ADM. The vulnerability occu…nvd · 2026-07-30