CVE-2026-23949

CVE-2026-23949 is a high-severity Zip Slip path traversal vulnerability affecting jaraco.context versions 5.2.0 through 6.0.0. This flaw allows attackers to extract files outside the intended directory when processing specially crafted malicious tar archives, including nested tarballs. The vulnerability has a CVSS score of 8.6 (HIGH) due to its network-based attack vector, low attack complexity, and potential for high confidentiality impact. While there is no known active exploitation, public exploit code, or KEV listing, the vulnerability has garnered significant community discussion with 11 mentions.