CopyEscape-CVE-2026-17106

CopyEscape: Tomando Control de Hosts Docker con docker cp CVE-2026-17106 Este es el repositorio de prueba de concepto para la entrada de blog CopyEscape: Taking Over Docker Hosts withdocker cp — CVE-2026-17106. CopyEscape permite que un contenedor malicioso en ejecución compita con el productor d...

CVE-2026-64824-PoC

CVE-2026-64824 — Home Assistant Core Backup-Restore Symlink Path Traversal → RCE CVSS 8.4 Critical · GHSA-cwh8-w64c-4j5h · CWE-22 / CWE-59 TL;DR Authenticated admin attacker uploads a crafted backup tar. The restore path extracts the inner homeassistant.tar.gz with filter="fullytrusted" and only...

CVE-2025-68937

CVE-2025-68937 - RCE por Symlink en Plantillas de Gitea/Forgejo Prueba de concepto automatizada para CVE-2025-68937 : salto de directorio mediante el seguimiento de enlaces simbólicos en el procesamiento de repositorios plantilla de Gitea y Forgejo, que conduce a la ejecución remota de código...

CVE-2026-89258

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

OPENSUSE-SU-2026:21832-1 Security update for acl, attr

This update for acl, attr fixes the following issue: - CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr, getfacl/setfacl/chacl, libacl bsc1268867. Changes for acl: - Update to 2.4.0 jscPED-16501: Major Issues Fixed: - The libacl library...

CVE-2026-77159

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

CVE-2026-89258

Hugo (static site generator) versions after v0.123.0 and before v0.165.0 are vulnerable to a symlink confinement bypass via direct resource lookups such as resources.Get and os.ReadFile. Symlinks in parent directories were not dropped during these lookups, allowing an attacker who can place a sym...

CVE-2026-89258 Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

CVE-2026-89258 Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

CVE-2026-89258 Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

EUVD-2026-76070

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

CVE-2026-77159 Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

EUVD-2026-76034

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

CVE-2026-77159

A symlink-following flaw in libvirt's qemuTPMEmulatorPrepareHost() function performs a path-based chown() on the swtpm log file without validating for symbolic links. A local attacker with access to the swtpm account can replace the log file with a symlink, causing the root-level libvirtd daemon ...

CVE-2026-77159

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

CVE-2025-8110

CVE-2025-8110 – PoC de RCE para Gogs ≤ 0.13.3 Prueba de concepto para CVE-2025-8110 , una escritura arbitraria de archivos autenticada en Gogs ≤ 0.13.3 causada por un manejo incorrecto de enlaces simbólicos en la API PutContents. Un usuario autenticado puede crear un commit con un enlace simbólic...

binwalk

Binwalk Binwalk es una herramienta rápida y fácil de usar para analizar, realizar ingeniería inversa y extraer imágenes de firmware. Aviso de fin de vida útil EOL Este fork nació para corregir algunos problemas pendientes de binwalk v2 y, en general, para mantenerlo en buen estado. Cumplió su...

MAL-014

MAL-014: Lectura autenticada de archivos arbitrarios en VMware vCenter Server El componente de API “com.vmware.appliance.version1.system.update.set” es vulnerable a un ataque de inyección de flags que puede aprovecharse con el plugin “com.vmware.showlog” para leer archivos arbitrarios como el...

CVE-2026-11111-TOCTOU-in-File-Permission-Check-Before-Open

CVE-2026-11111 – TOCTOU in File Permission Check Before Open Program Code Python root@kitploit: toctouserver.py - File server that checks permission then opens import os, time, tempfile from flask import Flask, request app = Flaskname SAFEDIR = '/tmp/safe' @app.route'/read' def readfile: filename...

path-auditor

PathAuditor PathAuditor 是一个通过审计 libc 函数来发现文件访问相关漏洞的工具。 其思路大致如下： 审计二进制程序执行的每个与文件系统相关的 libc 函数调用。 检查系统调用中使用的路径是否为用户可写。如果是，非特权用户可能已用符号链接替换了目录或文件。 将所有违规记录为潜在漏洞。 我们使用 LDPRELOAD 来钩住所有与文件系统相关的库调用，并将遇到的任何违规记录到 syslog。 这不是谷歌官方支持的产品。 漏洞示例 让我们看看这个工具可以检测的一种漏洞示例。CVE-2019-3461 是 tmpreaper 中的一个 bug，tmpreaper...