CVE-2026-108906

A vulnerability exists in Netcore NR268 version 1.7.121109 within the filter_arp_put_file_cgi function of the file /router/filter_arp_put_file.cgi . By manipulating the put_file argument, an attacker can trigger an out-of-bounds read . This flaw can be exploited remotely , and public exploits hav...

CVE-2026-108906 Netcore NR268 filter_arp_put_file.cgi filter_arp_put_file_cgi out-of-bounds

A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filterarpputfilecgi of the file /router/filterarpputfile.cgi. The manipulation of the argument putfile leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed ...

CVE-2026-101053

A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUTFILE of the file /tmp/wpasupplicant.conf of the component TCP Service. Executing a manipulation of the argument path can lead to improper access controls. The attack may be launched remotely. The exploit...

EUVD-2026-88221

A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUTFILE of the file /tmp/wpasupplicant.conf of the component TCP Service. Executing a manipulation of the argument path can lead to improper access controls. The attack may be launched remotely. The exploit...

CVE-2026-101053 Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control

A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUTFILE of the file /tmp/wpasupplicant.conf of the component TCP Service. Executing a manipulation of the argument path can lead to improper access controls. The attack may be launched remotely. The exploit...

CVE-2026-101053 Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control

A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUTFILE of the file /tmp/wpasupplicant.conf of the component TCP Service. Executing a manipulation of the argument path can lead to improper access controls. The attack may be launched remotely. The exploit...

CVE-2026-101053

The Thinkware U3000 (up to version 1.02.04 ) contains a vulnerability in the TCP Service component. Specifically, the PUT_FILE function involving the file /tmp/wpa_supplicant.conf is susceptible to improper access controls when an attacker manipulates the argument path . This flaw can be exploite...

CVE-2026-101053: Improper Access Control

A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUTFILE of the file /tmp/wpasupplicant.conf of the component TCP Service. Executing a manipulation of the argument path can lead to improper access controls. The attack may be launched remotely. The exploit...

CVE-2026-55074

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands foll...

CVE-2026-55074 Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands foll...

EUVD-2026-83940

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands foll...

CVE-2026-55074 Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands foll...

CVE-2026-55074 Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands foll...

CVE-2026-55074

CVE-2026-55074 affects the Ansible FreeBSD Jail Connection Plugin (jailexec) through version 1.3.0 . The put_file function resolved transfer destinations to paths on the jail host and executed mkdir -p and mv as root on the host , rather than inside the jail. Because these commands follow symboli...

CVE-2026-55074: Improper Link Resolution Before File Access

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands foll...

Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the...

PYSEC-2026-3658 Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the...

Symlink Attack

Overview ansible-jailexec is an Ansible connection plugin for FreeBSD jails via jexec over SSH Affected versions of this package are vulnerable to Symlink Attack via the putfile process. An attacker can perform arbitrary root-owned file writes on the host system by placing a symbolic link inside...

Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the...

GHSA-CXGV-HP74-JJ7R Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Through version 1.3.0, the jailexec connection plugin's putfile resolved a transfer's destination to a path on the jail host + and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the...