https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T17:35:10.019662+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-nats-2022-26652 BIT-nats-2022-26652 2026-10-07T17:35:10.026400+00:00

Affected: Bitnami: nats

NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0199 certfr-2026-avi-0199 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaq… 2026-10-07T17:35:10.026469+00:00 certfr-2026-avi-0199 https://cve.radiocsirt.org/vuln/euvd-2026-15033 EUVD-2026-15033 2026-10-07T17:35:10.026500+00:00 EUVD-2026-15033 https://cve.radiocsirt.org/vuln/fkie_cve-2022-26652 fkie_cve-2022-26652 2026-10-07T17:35:10.026521+00:00

NATS nats-server before 2.7.4 allows Directory Traversal (with write access) via an element in a ZIP archive for JetStream streams. nats-streaming-server before 0.24.3 is also affected.

 https://cve.radiocsirt.org/vuln/ghsa-6h3m-36w8-hv68 GHSA-6h3m-36w8-hv68 — Arbitrary file write in nats-server 2026-10-07T17:35:10.026557+00:00

Affected: Go: github.com/nats-io/nats-server/v2, Go: github.com/nats-io/nats-streaming-server

(This document is canonically: <https://advisories.nats.io/CVE/CVE-2022-26652.txt>)

## Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

JetStream is the optional RAFT-based resilient persistent feature of NATS.

## Problem Description

The JetStream streams can be backed up and restored via NATS. The backup format is a tar archive file. Inadequate checks on the filenames within the archive file permit a so-called "Zip Slip" attack in the stream restore.

NATS nats-server through 2022-03-09 (fixed in release 2.7.4) did not correctly sanitize elements of the archive file, thus a user of NATS could cause the NATS server to write arbitrary content to an attacker-controlled filename.

## Affected versions

NATS Server: * 2.2.0 up to and including 2.7.3. + Introduced with JetStream Restore functionality * Fixed with nats-io/nats-server: 2.7.4 * Docker image: nats <https://hub.docker.com/_/nats> * NB users of OS package files from our releases: a change in goreleaser defaults, discovered late in the release process, moved the install directory from /usr/local/bin to /usr/bin; we are evaluating the correct solution for subsequent releases, but not recutting this release.

NATS Streaming Server * 0.15.0 up to and including 0.24.2 * Fixed with nats-io/nats-streaming-server: 0.24.3 * Embeds a nats-server, but this server is the old approach which JetStream replac…

 https://cve.radiocsirt.org/vuln/gsd-2022-26652 gsd-2022-26652 2026-10-07T17:35:10.026643+00:00 gsd-2022-26652