CVE-2020-10665

CVE-2020-10665 Escalada de Privilegios Local en Docker Desktop POC para la escalada de privilegios local en Docker Desktop. Construido basado en el artículo en https://www.activecyber.us/activelabs/docker-desktop-local-privilege-escalation-cve-2020-10665. Creación de hardlink adaptada de...

CVE-2025-3464-AsIO3-LPE

CVE-2025-3464-AsIO3-LPE CVE-2025-3464: Exploit de escalación local sin privilegios para AsIO3.sys de ASUS - Bypass de autenticación TOCTOU + Decremento de PreviousMode CVE-2025-3464: Escalación de Privilegios Local en AsIO3.sys Este exploit solo funciona en Windows 11 22H2 o anterior. Microsoft...

CVE-2025-4517-POC

CVE-2025-4517 利用 说明 本利用及描述由AI编写。如果发现任何错误或问题，请告知我！本利用已测试并确认有效。感谢！ 概述 本利用利用了 CVE-2025-4517 ，这是 Python tarfile 模块中的一个严重漏洞，通过组合符号链接路径遍历与硬链接操纵，可实现任意文件写入。该漏洞绕过了 Python 3.12 中引入的 filter="data" 保护机制。 漏洞详情 CVE ID : CVE-2025-4517 受影响版本 : Python 3.8.0 至 3.13.1 CVSS 评分 : 9.3（严重） 影响 : 以提升的权限进行任意文件写入 技术背景 该漏洞利...

CVE-2025-55188

CVE-2025-55188：7-Zip 任意文件写入 CVE-2025-55188 的概念验证，这是 7-Zip 中的一个任意文件写入漏洞。该漏洞已在 2025 年 8 月 3 日发布的 25.01 版本中修复。 注意：CVE-2025-55188 与 CVE-2025-11001 不同。 修复 CVE-2025-11001 的版本（25.00 版）仍然容易受到 通过符号链接攻击导致的任意代码执行的影响，原因是 CVE-2025-55188。 CVE-2025-55188 的发现和发布早于 CVE-2025-11001 的发布。 有关更详细的说明和漏洞分析，请参阅...

CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

DEBIAN-CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

OESA-2026-4081 tar security update

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fixes: A flaw was found in G...

SharpPolarBear

SharpPolarBear 这是 SandboxEscaper 在此处（https://github.com/SandboxEscaper/polarbearrepo）发布的其中一个漏洞的武器化版本。 大部分代码来自 rasta-mouse 的 CollectorService 仓库（https://github.com/rasta-mouse/CollectorService）。我只是将原始 SandboxEscaper C++ 代码中的 CVE-2019-0841 漏洞代码改为了 C，并添加了一些检查。 我还加入了所需的二进制文件（schtasks.exe、schedsvc.dll...

CVE-2026-29786

CVE-2026-29786 Research: Joshua van Rijswijk Description This repository contains a Proof of Concept PoC for CVE-2026-29786 , a vulnerability in the tar npm package that allows a crafted archive to create a hardlink pointing outside the intended extraction directory. The issue occurs when a tar...

research

Investigación de Seguridad Repositorio dedicado a mis descubrimientos de vulnerabilidades de seguridad CVEs. Este repositorio contiene documentación técnica detallada, exploits de prueba de concepto y análisis de las vulnerabilidades descubiertas. Acerca de Este repositorio agrupa todos los CVEs...

tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary...

CVE-2026-47699

A flaw was found in Confidential Containers Guest Components. A workload owner can exploit a vulnerability in the image-rs library's hardlink fallback mechanism by providing a crafted OCI Open Container Initiative image layer. This allows for an arbitrary file write outside the intended directory...

OESA-2026-3912 tar security update

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fixes: A flaw was found in G...

OESA-2026-3911 tar security update

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fixes: A flaw was found in G...

BIT-PYTHON-2026-87910 tarfile hardlink fallback ignores custom extraction filter rejection via None

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

BIT-PYTHON-MIN-2026-87910 tarfile hardlink fallback ignores custom extraction filter rejection via None

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

BIT-LIBPYTHON-2026-87910 tarfile hardlink fallback ignores custom extraction filter rejection via None

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

Updated tar packages fix security vulnerabilities

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. CVE-2025-45582 Tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape. CVE-2026-18477 Tar: --one-top-level hardlink targets not confined to...