CVE-2020-10665

CVE-2020-10665 Escalada de Privilegios Local en Docker Desktop POC para la escalada de privilegios local en Docker Desktop. Construido basado en el artículo en https://www.activecyber.us/activelabs/docker-desktop-local-privilege-escalation-cve-2020-10665. Creación de hardlink adaptada de...

CVE-2025-3464-AsIO3-LPE

CVE-2025-3464-AsIO3-LPE CVE-2025-3464: Unprivileged LPE exploit for ASUS AsIO3.sys - TOCTOU auth bypass + PreviousMode decrement CVE-2025-3464: AsIO3.sys Local Privilege Escalation This exploit will only work on Windows 11 22H2 or earlier. Microsoft fixed PreviousMode hijinks. Local privilege...

CVE-2025-4517-POC

Exploit CVE-2025-4517 NOTAS Este exploit y su descripción están escritos por IA. Si encuentras un error o problema, ¡por favor házmelo saber! Este exploit fue probado y confirmado que funciona. ¡Gracias! Resumen Este exploit aprovecha CVE-2025-4517 , una vulnerabilidad crítica en el módulo tarfil...

CVE-2025-55188

CVE-2025-55188: 7-Zip Arbitrary File Write Proof-of-concept of CVE-2025-55188, an arbitrary file write in 7-Zip. Patched in version 25.01, released on August 3, 2025. Note: CVE-2025-55188 is different than CVE-2025-11001. The version that CVE-2025-11001 was patched in version 25.00 is still...

CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

DEBIAN-CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

CVE-2026-96279: Improper Link Resolution Before File Access

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

OESA-2026-4081 tar security update

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fixes: A flaw was found in G...

SharpPolarBear

SharpPolarBear Esta es una versión armada de uno de los exploits publicados por SandboxEscaper desde aquí https://github.com/SandboxEscaper/polarbearrepo. La mayor parte del código proviene del repositorio CollectorService de rasta-mouse https://github.com/rasta-mouse/CollectorService. Solo cambi...

CVE-2026-29786

CVE-2026-29786 Research: Joshua van Rijswijk Description This repository contains a Proof of Concept PoC for CVE-2026-29786 , a vulnerability in the tar npm package that allows a crafted archive to create a hardlink pointing outside the intended extraction directory. The issue occurs when a tar...

research

Investigación de Seguridad Repositorio dedicado a mis descubrimientos de vulnerabilidades de seguridad CVEs. Este repositorio contiene documentación técnica detallada, exploits de prueba de concepto y análisis de las vulnerabilidades descubiertas. Acerca de Este repositorio agrupa todos los CVEs...

tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary...

CVE-2026-47699

A flaw was found in Confidential Containers Guest Components. A workload owner can exploit a vulnerability in the image-rs library's hardlink fallback mechanism by providing a crafted OCI Open Container Initiative image layer. This allows for an arbitrary file write outside the intended directory...

OESA-2026-3912 tar security update

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fixes: A flaw was found in G...

OESA-2026-3911 tar security update

GNU Tar provides the ability to create tar archives, as well as various other kinds of manipulation. For example, you can use Tar on previously created archives to extract files, to store additional files, or to update or list files which were already stored. Security Fixes: A flaw was found in G...

BIT-PYTHON-2026-87910 tarfile hardlink fallback ignores custom extraction filter rejection via None

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

BIT-PYTHON-MIN-2026-87910 tarfile hardlink fallback ignores custom extraction filter rejection via None

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...

BIT-LIBPYTHON-2026-87910 tarfile hardlink fallback ignores custom extraction filter rejection via None

When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...