61 matches found
CVE-2026-96807
A flaw was found in Flatpak. A malicious sandboxed application can manipulate a symlink, causing the regenerateldcache function to write files to an unintended location. While the attacker cannot control the content or filenames, this vulnerability could lead to a low impact on system integrity o...
CVE-2025-8110
CVE-2025-8110 Ejecución Remota de Código mediante Enlace Simbólico en Repositorios de Gogs Creado por oguiii Índice de Contenidos Resumen Características Requisitos Instalación Uso Flujo de Explotación Análisis Técnico Demostración Prueba de Concepto Versiones Afectadas Mitigación Detección Aviso...
CVE-2025-27591-PoC
CVE-2025-27591 概念验证 CVE-2025-27591 是一个权限提升漏洞，影响了低于 0.9.0 版本的 Below 服务。问题源于在 /var/log/below 目录下创建了一个全局可写目录。攻击者可以通过操作该目录中的符号链接来利用此漏洞，并有可能获取 root 权限，这对本地非特权用户构成重大安全威胁。 此概念验证代码仅用于教育和研究目的。 在编写本文时，社区中尚无该漏洞的公开 PoC。因此，我决定负责任地分享此实现，以填补这一空白，为安全研究生态系统做出贡献，并提高人们对不安全文件系统关键性质的认识。 漏洞成因 概念验证 在攻击者机器上： 1- git clon...
Amazon Linux 2 : runc (ALASNITRO-ENCLAVES-2026-119)
The version of runc installed on the remote host is prior to 1.3.6-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-119 advisory. x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name...
CVE-2026-86422
A flaw was found in ImageMagick. This vulnerability, known as a time-of-check-time-of-use TOCTOU flaw, affects path policy enforcement on Windows. A local attacker can exploit this by manipulating symbolic links symlinks during the brief interval between when the system checks a file's permission...
CVE-2026-53796
rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to redirect file writes to unintended locations. Attackers can...
EUVD-2026-40117
Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution...
Anthropic Claude Code 2.1.38 < 2.1.163 Sandbox Escape (CVE-2026-55607)
The version of Anthropic Claude Code installed on the remote host is 2.1.38 prior to 2.1.163. It is, therefore, affected by a sandbox escape vulnerability: - Claude Code's worktree handling allowed creation of worktrees named '.git' and navigation to worktrees outside the sandbox context, enablin...
CVE-2026-55607
Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor...
CVE-2026-55607 Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution
Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor...
CVE-2026-55607
Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor...
CVE-2026-55607
CVE-2026-55607 affects Claude Code 2.1.38–2.1.163; worktree handling allowed creation of ".git" worktrees and navigation outside the sandbox, enabling git directory confusion. Exploit via symlink manipulation and git fsmonitor during worktree operations could overwrite home-dir files (e.g., .zshe...
CVE-2026-55607 Claude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution
Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor...
CVE-2026-55607: Improper Limitation of a Pathname to a Restricted Directory
Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor...
CVE-2026-2638
A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption...
CVE-2026-2638
A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption...
EUVD-2026-35404
A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption...
CVE-2026-2638 X-VPN macOS website versions - Local Privilege Escalation
A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption...
CVE-2026-2638 X-VPN macOS website versions - Local Privilege Escalation
A vulnerability in the quarantine and restore workflow of the X-VPN macOS website versions 77.0 through 77.5 allow a local attacker to leverage a race condition and symlink manipulation to achieve privileged file corruption...