AWS-SAM-CLI-Vulnerabilities

AWS SAM CLI 취약점 CVE-2025-3047 & CVE-2025-3048 이 README는 AWS Serverless Application Model CLIAWS SAM CLI에서 발견된 두 가지 보안 취약점인 CVE-2025-3047 및 CVE-2025-3048과 코드 수준의 문제 및 수정 사항에 대한 상세 분석을 제공합니다. 두 취약점 모두 Docker 컨테이너를 사용한 빌드 프로세스 중 심볼릭 링크심링크를 부적절하게 처리하는 것과 관련됩니다. 아래의 각 섹션은 하나의 CVE를 요약, 영향을 받는 코드SAM CLI...

CVE-2025-9074-Docker-Exploit

CVE-2025-9074 Docker コンテナコマンド実行ツール CVE-2025-9074 の脆弱性のセキュリティ研究とテストのための、強力な Docker リモート API エクスプロイトツールです。 主な利点 ✅ 完全自動のコンテナライフサイクル管理 : 一時コンテナを自動作成し、操作完了後に自動クリーンアップして痕跡を残しません ✅ インテリジェントなパス処理 : Windows パスを自動的に認識して Docker マウント形式に変換します ✅ 完全自動化された操作フロー : 複雑なコマンドの手動入力は不要で、メニュー形式の対話によりワンクリックでファイル操作を完了します ...

CVE-2025-62878

CVE-2025-62878: Local Path Provisioner 경로 탐색 취약점 개요 항목| 값 ---|--- CVE ID| CVE-2025-62878 GHSA ID| GHSA-jr3w-9vfr-c746 심각도| 치명적 CVSS 10.0 CWE| CWE-23 상대 경로 탐색 영향받는 구성 요소| rancher/local-path-provisioner 영향받는 버전| v0.0.27 v0.0.32 수정된 버전| v0.0.33+ 취약점 설명 StorageClass의 pathPattern 매개변수에 경로 탐색 취약점이 존재합니...

docker-cve-2022-39253-poc

docker 호스트 파일 읽기 cve-2022-39253 활용 poc PoC 환경 재현 $ docker run --name=cve-2022-39253 -ti -d ssst0n3/dockerarchive:gitcve-2022-39253 $ docker attach --detach-keys ctrl-x cve-2022-39253 use ctrl-x to exit container's terminal wait minutes for environment starting ... ... Ubuntu 22.04 LTS ubuntu ttyS...

K000163497: Podman vulnerability CVE-2024-11218

Security Advisory Description A vulnerability was found in podman build and buildah. This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of...

Rocky Linux 9.6 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.6:CLSA-2026:1790035964)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790035964 advisory. - In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalat...

Rocky Linux 9 [CIQ] Security Update: yelp / yelp-debuginfo / yelp-debugsource / yelp-devel / yelp-libs / etc (crlsa-2026_47178)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202647178 advisory. yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications CVE-2026-13601 Tenable has extracted the...

Rocky Linux 8 [CIQ] Security Update: yelp / yelp-debuginfo / yelp-debugsource / yelp-devel / yelp-libs / etc (crlsa-2026_47177)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202647177 advisory. yelp: yelp-xsl: Overly Permissive Content Security Policy in Yelp Allows Host File Disclosure from Flatpak Applications CVE-2026-13601 Tenable has extracted the...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: runc (UTSA-2026-126154)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-126154 advisory. runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1, 1.4.0-rc.12, 1.5.0-rc.1, and...

AlmaLinux 9.2 [TuxCare] Security Update: runc (ALMALINUX9.2:CLSA-2026:1784034091)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784034091 advisory. - runc is a CLI tool for spawning and running containers according to the OCI specification. In versions prior to 1.3.6, 1.4.0-rc.1,...

CVE-2026-5555-Container-Escape-via-proc-self-fd-Symlink-in-Shared-Volume

CVE-2026-5555 – /proc/self/fd シンボリックリンクによるコンテナエスケープ 概要 rshared 伝播でマウントされた共有ボリュームにより、悪意のあるコンテナが /proc/self/fd を介してホストファイルを指すシンボリックリンクを作成できます。ボリュームに書き込むホストプロセスがそのシンボリックリンクを辿ることで、重要なホストファイルが上書きされ、コンテナからのエスケープが発生します。 脆弱性の詳細 種類: コンテナエスケープ / シンボリックリンク攻撃 影響: ホストファイルの上書き、ホスト上での root への権限昇格。 根本原因:...

poc-cve-2024-0132

poc-cve-2024-0132 재현 환경: os: ubuntu 22.04 with nvidia driver docker: v27.1.0 nvidia-container-toolkit: v1.16.1 재현 단계: poc 컨테이너 이미지 실행 목표: 컨테이너 내에서 호스트 파일 접근 컨테이너 내 docker.sock을 통해 Docker 데몬 API 호출 재현 사전 빌드된 poc 이미지 ssst0n3/poc-cve-2024-0132를 사용하거나, 소스에서 직접 빌드하세요. root@wanglei-gpu3: git clone...

Medium: runc

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

DEBIAN-CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

CVE-2026-96279 Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

CVE-2025-9074

설명 Vibe가 의존성이 필요 없는 순수 Bash로 작은 익스플로잇 스크립트를 작성했습니다. 이 스크립트는 내부 Docker API와 통신하여 새 컨테이너를 생성하고 시작하며, 호스트 C 드라이브를 마운트한 후 그 안에서 명령을 실행합니다. 출력은 콘솔로 스트리밍됩니다. 이후 컨테이너는 제거됩니다. 사용법 ./exploit.sh "whoami"...

CVE-2025-9074-PoC-Bash

CVE-2025-9074-PoC-Bash 원본 PoC는 다음 링크에 있습니다: https://github.com/j3r1ch0123/CVE-2025-9074. 이는 bash 버전의 새로운 PoC입니다. 모든 도커 컨테이너에 파이썬이 설치되어 있지 않고, 대부분의 경우 컨테이너 내부에서 실행되어야 하기 때문입니다. 단계 컨테이너 내부에서 취약한 도커 API를 찾으려면 다음을 사용하십시오: for ip in 172.18.0.1 172.17.0.1 192.168.65.7; do echo /dev/tcp/$ip/2375...

EUVD-2026-87514

OpenClaw versions before 2026.8.1 fail to validate all source fields in structured message attachments, allowing attackers to hide unvalidated host paths behind allowed attachment sources. Attackers can exploit this by providing multiple source fields to bypass sandbox path validation and cause...