PT-2026-90350

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix ALIGN overflow in symlink data error context loop The check added by commit 7d9a7f1f96cd "smb/client: fix possible infinite loop and oob read in symlink data" compared the post-ALIGN length against the remaining...

PT-2026-90415

In the Linux kernel, the following vulnerability has been resolved: nfsd: validate symlink target length in NFSv4 CREATE nfsd4 decode create accepts an unbounded cr datalen from the wire for NF4LNK symlink targets, allowing a client to force a kmalloc of up to the maximum RPC payload size several...

Linux Distros Unpatched Vulnerability : CVE-2026-88265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in crun. After pivotroot, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's...

Linux Distros Unpatched Vulnerability : CVE-2026-88016

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with...

Linux Distros Unpatched Vulnerability : CVE-2026-77159

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking...

PT-2026-89861

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

Linux Distros Unpatched Vulnerability : CVE-2026-89258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups,...

CVE-2025-4138-POC

CVE-2025-4138 - Python tarfile PATHMAX 绕过 PoC 作者： d3vn0mi root@kitploit: / \ \ / / | | / \ | | | | || | / | | \ V /| | | | | | | \ | | || || / \ | | | | | ||/ /| || / / || | , | | || || ||/|/ |||/ // CVE-2025-4138 :: Python tarfile PATHMAX 绕过 作者: d3vn0mi 概述 针对 CVE-2025-4138 的概念验证利用代码，这是一个...

rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

Summary With -l/--links, rclone's local backend recreates a source .rclonelink object as a real symlink at the destination verbatim preserved by design for faithful backups. Directory-metadata application, however, does not go through the os.Root sandbox and does not use NOFOLLOW syscalls. A loca...

GHSA-F8G7-2XJC-7MFH rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

Summary With -l/--links, rclone's local backend recreates a source .rclonelink object as a real symlink at the destination verbatim preserved by design for faithful backups. Directory-metadata application, however, does not go through the os.Root sandbox and does not use NOFOLLOW syscalls. A loca...

GHSA-P6M2-R3W9-MPXW rclone local: crafted Range request against a translated symlink panics (DoS)

Summary When backend/local is used with --links/-l or the links=true config option, each symlink is exposed as an rclone object whose content is the target path string, suffixed .rclonelink. Object.Open decodes an incoming fs.RangeOption via Decodeo.Size, then for a translated-symlink object pass...

rclone local: crafted Range request against a translated symlink panics (DoS)

Summary When backend/local is used with --links/-l or the links=true config option, each symlink is exposed as an rclone object whose content is the target path string, suffixed .rclonelink. Object.Open decodes an incoming fs.RangeOption via Decodeo.Size, then for a translated-symlink object pass...

CVE-2025-4517-Python-tarfile-filter-data-Bypass-PoC

CVE-2025-4517 — Python tarfile filter="data" 绕过（PoC） Python tarfile 模块中的路径遍历漏洞，影响 3.8.0 至 3.13.1 版本。filter="data" 沙箱旨在防止不安全的解压操作，但可通过构造超过 PATHMAX（4096 字节）的路径来绕过，导致 os.path.realpath 静默停止解析符号链接。安全检查看到的是一个看似安全的路径，而内核解析的是真实路径，从而允许在解压目录之外写入文件。此 PoC 利用该绕过方式将 SSH 公钥写入 /root/.ssh/authorizedkeys。 工作原理 1...

CVE-2025-63946-Tencent-PC-Manager-EoP

CVE-2025-63946 Escalada de Privilegios en Tencent PC Manager versión: PCManager versión menor o igual a 17.10.28554.205 Resumen: Descubrí una vulnerabilidad en Tencent PC Manager donde los archivos y directorios bajo C:\Windows\Temp se manejan de forma insegura. Un atacante puede aprovechar ataqu...

CVE-2025-8110

Gogs RCE 漏洞利用 CVE-2025-8110 针对 CVE-2025-8110 的概念验证 — 通过符号链接绕过和 sshCommand 注入实现 Gogs 远程代码执行。 描述 该漏洞利用 Gogs API 中的符号链接绕过，覆盖 .git/config 并注入恶意 sshCommand，从而执行反弹 Shell。 需求 Python 3.12+ 已安装 Git 有效的 Gogs 凭据 Gogs API 令牌 安装 root@kitploit: git clone https://github.com/X4BROZER/CVE-2025-8110.git cd...

litespeed-cpanel-cve-2026-54420-fix

Kit de Mitigación CVE-2026-54420 Kit de remediación defensiva, auditoría y verificación para CVE-2026-54420 que afecta al Plugin LiteSpeed para cPanel en entornos de alojamiento compartido que utilizan CloudLinux / CageFS. ⚠️ Aviso de Seguridad Este repositorio está destinado únicamente a...

CVE-2026-88015

A flaw was found in rclone. When rclone is configured with backend/local and links=true, it exposes symlink targets as .rclonelink objects. A remote attacker can send a crafted Range request with an unchecked positive Range start, leading to a deterministic slice-bounds panic. This issue results ...

CVE-2026-68488

A Time-of-check Time-of-use TOCTOU race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover...

CVE-2026-68488

A Time-of-check Time-of-use TOCTOU race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover...

EUVD-2026-75594

A Time-of-check Time-of-use TOCTOU race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover...