674 matches found
CVE-2026-124745
A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extracti...
CVE-2026-124744
A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outsi...
CVE-2026-124745
A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extracti...
EUVD-2026-123407
A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extracti...
CVE-2026-124745
A flaw in BusyBox 's tar utility allows for an improper link resolution (CWE-59) during archive extraction. Specifically, the utility fails to correctly resolve deferred hardlink targets when they are accessed through deferred symlinks pointing outside the intended extraction directory. A malicio...
CVE-2026-124745 Busybox: tar deferred hardlink target resolved through a deferred symlink escapes the extraction directory
A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extracti...
CVE-2026-124744
A flaw in the BusyBox cpio utility allows for improper sanitization of hardlink target paths even when path traversal protection is enabled. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks pointing outside the intended directory. This vu...
CVE-2026-124744 Busybox: cpio hardlink target not sanitized under feature_path_traversal_protection
A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outsi...
EUVD-2026-123406
A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outsi...
CVE-2026-124744
A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outsi...
Important: Red Hat Security Advisory: sos security, bug fix, and enhancement update
An update for sos is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...
CVE-2025-55188
CVE-2025-55188: 7-Zip Arbitrary File Write Proof-of-concept of CVE-2025-55188, an arbitrary file write in 7-Zip. Patched in version 25.01, released on August 3, 2025. Note: CVE-2025-55188 is different than CVE-2025-11001. The version that CVE-2025-11001 was patched in version 25.00 is still...
CVE-2026-29786
CVE-2026-29786 Research: Joshua van Rijswijk Description This repository contains a Proof of Concept PoC for CVE-2026-29786 , a vulnerability in the tar npm package that allows a crafted archive to create a hardlink pointing outside the intended extraction directory. The issue occurs when a tar...
CVE-2025-3464-AsIO3-LPE
CVE-2025-3464-AsIO3-LPE CVE-2025-3464: Unprivileged LPE exploit for ASUS AsIO3.sys - TOCTOU auth bypass + PreviousMode decrement CVE-2025-3464: AsIO3.sys Local Privilege Escalation This exploit will only work on Windows 11 22H2 or earlier. Microsoft fixed PreviousMode hijinks. Local privilege...
CVE-2020-10665
CVE-2020-10665 Docker Desktop Local Privilege Escalation POC for Docker Desktop Local Privilege Escalation. Built based on the writeup at https://www.activecyber.us/activelabs/docker-desktop-local-privilege-escalation-cve-2020-10665. Hardlink creation adapted from...
Security update for tar
This update for tar fixes the following issues: CVE-2026-18477: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape bsc1274489. CVE-2026-18508: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite bsc1274490. Patch...
SharpPolarBear
SharpPolarBear This is a weaponized version for one of the Exploits published by SandboxEscaper from here https://github.com/SandboxEscaper/polarbearrepo. Most of the code comes from rasta-mouse CollectorService repository https://github.com/rasta-mouse/CollectorService. I just changed the...
Important: docker
Issue Overview: eStargz layer decoder in the estartgz package contains a vulnerability that an input containing a cyclic hardlink crashes the process with Go's unrecoverable stack overflow error. Stargz Snapshotter with the default configuration relies on that function so pulling an eStargz image...
Important: glibc
Issue Overview: A time-of-check to time-of-use TOCTOU race condition in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DTRPATH for setuid/setgid ATSECURE programs, glibc validates the lexical...
Important: docker
Issue Overview: eStargz layer decoder in the estartgz package contains a vulnerability that an input containing a cyclic hardlink crashes the process with Go's unrecoverable stack overflow error. Stargz Snapshotter with the default configuration relies on that function so pulling an eStargz image...