CVE-2025-8110

CVE-2025-8110 Gogs 仓库符号链接远程代码执行漏洞 由 oguiii 制作 目录 概述 功能特性 环境要求 安装 使用方法 漏洞利用流程 技术分析 概念验证演示 受影响版本 缓解措施 检测方法 免责声明 许可证 概述 CVE-2025-8110 是 Gogs 中的一个严重漏洞，允许经过身份验证的攻击者通过仓库符号链接操纵实现远程代码执行。此概念验证演示了从身份验证到获取反向 shell 的完整攻击链。 该漏洞的存在是因为 Gogs 在处理仓库文件时通过 API 跟随符号链接，使得攻击者能够读取和修改敏感文件（如 .git/config）。通过注入恶意的 sshComman...

CVE-2025-27591-PoC

CVE-2025-27591 概念验证 CVE-2025-27591 是一个权限提升漏洞，影响了低于 0.9.0 版本的 Below 服务。问题源于在 /var/log/below 目录下创建了一个全局可写目录。攻击者可以通过操作该目录中的符号链接来利用此漏洞，并有可能获取 root 权限，这对本地非特权用户构成重大安全威胁。 此概念验证代码仅用于教育和研究目的。 在编写本文时，社区中尚无该漏洞的公开 PoC。因此，我决定负责任地分享此实现，以填补这一空白，为安全研究生态系统做出贡献，并提高人们对不安全文件系统关键性质的认识。 漏洞成因 概念验证 在攻击者机器上： 1- git clon...

CVE-2026-53796

rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can...

EUVD-2026-40117

Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution...

Anthropic Claude Code 2.1.38 < 2.1.163 Sandbox Escape (CVE-2026-55607)

The version of Anthropic Claude Code installed on the remote host is 2.1.38 prior to 2.1.163. It is, therefore, affected by a sandbox escape vulnerability: - Claude Code's worktree handling allowed creation of worktrees named '.git' and navigation to worktrees outside the sandbox context, enablin...

CVE-2026-55607

Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor...

CVE-2026-55607

Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor...

CVE-2026-55607 Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor...

CVE-2026-55607

CVE-2026-55607 affects Claude Code 2.1.38–2.1.163; worktree handling allowed creation of ".git" worktrees and navigation outside the sandbox, enabling git directory confusion. Exploit via symlink manipulation and git fsmonitor during worktree operations could overwrite home-dir files (e.g., .zshe...

CVE-2026-55607 Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution

Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor...

CVE-2026-2638

A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption...

CVE-2026-2638

A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption...

CVE-2026-2638 X-VPN macOS website versions - Local Privilege Escalation

A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption...

EUVD-2026-35404

A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption...

CVE-2026-2638 X-VPN macOS website versions - Local Privilege Escalation

A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption...

CVE-2026-2638

Technical details beyond the summary are not publicly available in the provided documents. Monitor for updates.

PT-2026-47751

Name of the Vulnerable Software and Affected Versions X-VPN macOS website versions 77.0 through 77.5 Description A race condition and symlink manipulation in the quarantine and restore workflow allow a local attacker to achieve privileged file corruption. Recommendations At the moment, there is n...

github.com/containerd/containerd: containerd: Arbitrary host file read via symlink following in CRI checkpoint restore

A flaw was found in containerd, an open-source container runtime. The Container Runtime Interface CRI plugin incorrectly restores container logs from a checkpoint image. This vulnerability, categorized as a Path Traversal CWE-61, allows an attacker to read arbitrary files on the host system by...

📄 OSK Registry-Based Privilege Escalation / Symlink Attack

The provided code is a conceptual Windows privilege escalation exploit targeting the On-Screen Keyboard osk.exe and Accessibility AT registry infrastructure. It attempts to abuse weak trust boundaries between user-level registry configuration and system-level execution paths...

CVE-2026-35372 uutils coreutils ln Security Bypass via Improper Handling of the --no-dereference Flag

A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target even when the --no-dereference or -n flag is explicitly provided. The implementation previously only honored the "no-dereference" intent if the --force overwrite mode was also enabled. Thi...