CVE-2007-4559

demostración de CVE-2007-4559 ¿qué es esto? Esta es una demostración de cómo el manejo predeterminado de Python para la extracción de archivos tar anterior a Python v3.11.4 es vulnerable a un simple ataque de symlink. Las instrucciones a continuación describen cómo crear un payload malicioso. El...

podman: buildah: buildah/copier: Directory escape via crafted tar symlinks when used outside Buildah by non-root callers

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not...

Rocky Linux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790925399)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790925399 advisory. - rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell...

susvibes-jupyter-server-cve-2026-35397

Tarea de Benchmark SusVibes: Resolución de Rutas de Contenido del Servidor Jupyter Este repositorio contiene una tarea completa de benchmark estilo SusVibes construida a partir de una corrección de seguridad real de Python en Jupyter Server. La tarea está diseñada para evaluar si un agente puede...

AlmaLinux 9.2 [TuxCare] Security Update: tar (ALMALINUX9.2:CLSA-2026:1789128477)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789128477 advisory. - A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designate...

rsync: rsync: Directory escape via TOCTOU race condition in rrsync

A time-of-check to time-of-use TOCTOU race condition flaw in the rrsync restricted shell wrapper allows authenticated remote attackers to escape directory restrictions. By replacing a validated path component with a symbolic link prior to file transfer execution, an attacker can bypass intended...

CVE-2026-50181

CVE-2026-50181 Recorrido de directorios en las herramientas de archivo de Langroid permitía lectura/escritura fuera del directorio actual configurado. Aviso principal: GHSA-fg23-3346-88f5 Base de datos de avisos de GitHub: github.com/advisories/GHSA-fg23-3346-88f5 Crédito al investigador:...

RHEL 9 : python3.9 (RHSA-2026:74087)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:74087 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level...

CVE-2026-87798 LXD client recursive file pull allows directory escape via malicious VM agent

Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 fixed in 4.0.14, 5.0.10 and 5.21.8 on Linux allows an attacker with root access inside a virtual machine to write attacker-controlled files or directory trees to arbitrary...

CVE-2026-87798 LXD client recursive file pull allows directory escape via malicious VM agent

Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 fixed in 4.0.14, 5.0.10 and 5.21.8 on Linux allows an attacker with root access inside a virtual machine to write attacker-controlled files or directory trees to arbitrary...

CVE-2026-87798 LXD client recursive file pull allows directory escape via malicious VM agent

Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 fixed in 4.0.14, 5.0.10 and 5.21.8 on Linux allows an attacker with root access inside a virtual machine to write attacker-controlled files or directory trees to arbitrary...

CVE-2026-87798

The LXD CLI client (Canonical LXD versions 4.0.2 up to 6.9) contains an improper link resolution vulnerability in its recursive file pull feature. An attacker with root access inside a virtual machine can escape the directory and write attacker-controlled files or directory trees to arbitrary pat...

UBUNTU-CVE-2026-93986

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the...

CVE-2026-55062

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed ...

CVE-2026-55062 uniget: Path Traversal in Hook Files - Directory Escape Vulnerability

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed ...

CVE-2026-55062

CVE-2026-55062 affects uniget , a universal installer and updater for container tools. Prior to 0.27.6 , the hooks edit command in cmd/uniget/hooks.go (lines 135–160) concatenates an unvalidated hook filename with the hooks directory without sanitizing ../ sequences. The resulting path is passed ...

CVE-2026-55062 uniget: Path Traversal in Hook Files - Directory Escape Vulnerability

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed ...

GHSA-89M4-43J5-VHHX Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root

Summary LocalFolderExtractor validates only the final canonical file path before extraction. However, makeFile creates intermediate directories one path segment at a time without checking whether each created directory remains inside the destination folder. A malicious RAR entry can make the fina...

CVE-2026-86071 Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root

Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a crafted archive entry. LocalFolderExtractor.createFile validat...

CVE-2026-86071 Junrar: LocalFolderExtractor mkdir escape allows directory creation outside extraction root

Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a crafted archive entry. LocalFolderExtractor.createFile validat...