CVE-2025-8110-Gogs-RCE-Exploit

Gogs CVE-2025-8110 RCEエクスプロイト GogsのCVE-2025-8110 に対する自動化されたPythonエクスプロイトです。この脆弱性は、PutContents APIがファイルパスがシンボリックリンクかどうかを検証しないことを悪用して、リモートコード実行（RCE）を可能にします。シンボリックリンクを介して内部の.git/configファイルを上書きすることで、悪意のあるsshCommandを注入し、リバースシェルをトリガーします。 🛠️ 前提条件 Python 3と必要な依存関係がインストールされていることを確認してください： root@kitploit: pi...

litespeed-cpanel-cve-2026-54420-fix

Набор средств для смягчения CVE-2026-54420 Набор инструментов для защитного устранения, аудита и проверки для CVE-2026-54420 , затрагивающего LiteSpeed cPanel Plugin в средах общего хостинга, использующих CloudLinux / CageFS. ⚠️ Уведомление по безопасности Этот репозиторий предназначен только для...

CVE-2026-31802

🛡️ CVE-2026-31802 - 간단한 개념 증명 뷰어 📋 CVE-2026-31802 소개 이 리포지토리는 CVE-2026-31802에 대한 개념 증명PoC과 기술 문서를 제공합니다. 이 문제는 npm tar 패키지의 보안 취약점입니다. 공격자가 심볼릭 링크와 경로 탐색을 악용하여 소프트웨어가 허용된 폴더 외부에 파일을 쓰도록 속일 수 있습니다. 이는 허가 없이 컴퓨터의 중요한 파일을 덮어쓸 수 있습니다. 이 취약점을 이해하고 테스트하면 보안을 개선하는 데 도움이 됩니다. 이 프로젝트는 취약점이 어떻게 작동하는지 보여주고 보...

CVE-2025-27591

CVE-2025-27591 – Повышение привилегий через злоупотребление симлинками в below 🛑 Отказ от ответственности : Данный эксплойт предоставлен только для образовательных целей и авторизованного тестирования безопасности. Несанкционированное использование может быть незаконным. 🧠 Обзор below — это...

CVE-2026-65010 Datasets Symlink-following Arbitrary File Write via Extractor.extract()

Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extraction to arbitrary filesystem locations in...

CVE-2026-16552

Removed by vendor...

acl: Symlink traversal privilege escalation via libacl functions

A flaw was found in the acl package, specifically within its libacl pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list ACL read or write operations to...

CVE-2026-64615

Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in graph.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readable...

CVE-2026-65067

CVE-2026-65067 affects Data::Intern::Shared prior to 0.02 for Perl. The code creates a world-readable mmap backing file via open(path, O_RDWR|O_CREAT, 0666) with mode 0666, which becomes 0644 under the default umask. Absence of O_NOFOLLOW means a symlink at the path is followed, and absence of O_...

EUVD-2026-45941

A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...

Exploit for Path Traversal in Gogs

Gogs Arbitrary File Write to RCE CVE-2025-8110 - Exploit de...

Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases

SummaryThe SQLite databases are created at predictable static paths in /tmp. Any user can therefore create a symlink at these paths in /tmp pointing to arbitrary files. The monitoring scripts then follows these symlinks and then creates their database at the symlink target.This becomes really...

CVE-2026-14904

AWS Research and Engineering Studio RES is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS. Improper link resolution before file access issue CWE-59 in the Auth.GetUserPrivateKey API. An authenticated remot...

EUVD-2026-42056

AWS Research and Engineering Studio RES is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS. Improper link resolution before file access issue CWE-59 in the Auth.GetUserPrivateKey API. An authenticated remot...

CVE-2026-59195

CVE-2026-59195 affects pnpm prior to versions 10.34.4 and 11.8.0. The issue arises when pnpm reads package names from the env lockfile’s configDependencies section and uses those names directly to create config dependency symlinks under node_modules/.pnpm-config. A crafted pnpm-lock.yaml with a t...

CVE-2026-46406

Claude Code is an agentic coding tool. From 2.1.59 until 2.1.128, the Claude Code /copy command wrote responses to a hardcoded, predictable path /tmp/claude/response.md without UID isolation, randomness, or symlink protection. The file was created world-readable 0644 in a world-traversable...

GHSA-RHQ6-9RGH-V45C Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container

In wings/internal/ufs/fsunix.go line 92-94, this function is defined and is used to change permissions of files in the server: go func fs UnixFS fchmodatop string, dirfd int, name string, mode FileMode error return ensurePathErrorunix.Fchmodatdirfd, name, uint32mode, 0, op, name This call to the...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via a crafted symlink in the templates directory during image import or instance backup restoration processes. An attacker can access and modify arbitrary files on the host system, potentially leadi...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path through the record-output process. An attacker can create or overwrite files on the host system by exploiting a crafted symlink in a container image, which can lead to arbitrary command execution...

PT-2026-53011

Name of the Vulnerable Software and Affected Versions Incus affected versions not specified Description An arbitrary file write issue exists on the host system when using a crafted image. The /instances/$name/exec endpoint uses the record-output parameter to store command output in the exec-outpu...