brightio CVE debriefs

CVE-2026-50558

Penelope Shell Handler, a post-exploitation shell handler for authorized security testing, had a vulnerability prior to version 0.20.0. The Unix download() implementation in penelope.py used tar.extractall(local_download_folder) on tar archives returned by remote sessions without validating member paths. This allowed a malicious or compromised session to write files outside the intended download directory [truncated]