CVE-2025-24104

Análisis de CVE-2025-24104: Lectura de archivos fuera del sandbox Reporté un bug que Apple luego rastreó como CVE-2025-24104. En mi informe original, demostré cómo una copia de seguridad maliciosa podía usarse para eludir las restricciones del sandbox. Sin embargo, la descripción inicial de Apple...

cve-2025-8110-GOGS-RCE

GOGS RCE cve-2025-8110 Gogs es un servicio Git ligero y autoalojado similar a una versión privada de GitHub, diseñado para ejecutarse fácilmente en servidores de bajos recursos. La vulnerabilidad CVE-2025-8110 es un fallo de seguridad crítico que permite a un atacante eludir las restricciones de...

CVE-2020-1337

CVE-2020-1337 CVE-2020-1337 es un bypass del parche de PrintDemon CVE-2020-1048 mediante un Directorio de Unión, creado para remediar una vulnerabilidad de Elevación de Privilegios EoP\Escalada Local de Privilegios LPE que afecta al Servicio de Cola de Impresión de Windows. La vulnerabilidad sí...

trellix-tarslip-patch-bypass

trellix-tarslip-patch-bypass Nel 2023, Trellix ha annunciato 1 di aver corretto oltre 61.000 progetti open source per CVE-2007-4559, una vecchia vulnerabilità di path traversal. Analizzando la loro patch, è facile notare che può essere aggirata utilizzando un symlink. Il path traversal tramite...

Gogs <= 0.13.3 - Remote Code Execution

Gogs self-hosted Git service versions 0.13.3 and earlier contain a critical symlink bypass vulnerability that circumvents the fix for CVE-2024-55947. Authenticated users can exploit improper symbolic link handling in the PutContents API to overwrite files outside the repository by committing a...

CVE-2026-62384

A flaw was found in NLTK. The FramenetCorpusReader component is vulnerable to a symlink-based sandbox bypass. An attacker can exploit this by placing specially crafted symbolic links within a corpus subdirectory. These symlinks bypass path validation, allowing the attacker to read arbitrary XML...

CVE-2026-19693

A flaw was found in extract-zip. This vulnerability allows a remote attacker to perform an arbitrary file write outside the intended destination directory. By crafting a malicious zip archive containing a symbolic link symlink and a regular file with the same name, the attacker can bypass securit...

CVE-2025-8110

Exploit RCE di Gogs CVE-2025-8110 Proof of Concept per CVE-2025-8110 - Esecuzione di codice remoto in Gogs tramite bypass di symlink e iniezione di sshCommand. Descrizione Questo exploit abusa di un bypass di symlink nell'API di Gogs per sovrascrivere .git/config e iniettare un sshCommand malevol...

CVE-2026-79676 NLTK before 3.10.3 Path Traversal via Symlink Bypass

NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open instead of nltk.pathsec.open, allowing symlinks to escape trusted roots. Attackers who stage symlinked corpus files under a trusted data root can disclose...

CVE-2026-79676 NLTK before 3.10.3 Path Traversal via Symlink Bypass

NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open instead of nltk.pathsec.open, allowing symlinks to escape trusted roots. Attackers who stage symlinked corpus files under a trusted data root can disclose...

CVE-2026-79676

NLTK versions before 3.10.3 are affected by a path traversal vulnerability in its corpus readers. The root cause is that these readers reopen root-derived paths using the built-in open() instead of nltk.pathsec.open(), which fails to resolve symlinks confined to a trusted root. An attacker who ca...

PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

Summary PraisonAI's praisonai.code tool wrappers exported as CODETOOLS for agents expose a workspace setting that the module itself treats as a path-traversal security boundary — readfile, writefile, applydiff, and searchreplace explicitly call ispathwithindirectory and return "… is outside the...

UBUNTU-CVE-2026-62384

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validatio...

Astra Linux – Vulnerability in node-tar

The npm package “tar” also known as node-tar in versions prior to 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has a vulnerability related to arbitrary file creation/overwriting, due to insufficient symlink protection. node-tar aims to ensure that any file whose location would be modified by a symbolic link i...

Directory Traversal

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Directory Traversal via the gettag method in nltk/corpus/reader/ipipan.py, which is the single choke point for channels, domains, categories, a...

CVE-2026-62384

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validatio...

CVE-2026-62384 NLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.2

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validatio...

CVE-2026-62384 NLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.2

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validatio...

EUVD-2026-64338

NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root. Attackers can place symlinks with names containing no path separators inside the corpus subdirectory, which pass the path validatio...

CVE-2026-62384

NLTK (Python Natural Language Toolkit) versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader . An attacker who can place symlinks with names containing no path separators inside a corpus subdirectory can bypass the path validation guard and read arbitrary XML files...