CVE-2026-88265 Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown

A flaw was found in crun. After pivotroot, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed relea...

EUVD-2026-75360

A flaw was found in crun. After pivotroot, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed relea...

CVE-2026-88265 Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown

A flaw was found in crun. After pivotroot, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed relea...

CVE-2026-88265

crun (a container runtime) is affected by a flaw where, after pivot_root , reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, allowing the container to change that file's ownership (chown). This effectively permits a host bind-mount write and chown from ...

CVE-2026-88265

A flaw was found in crun. After pivotroot, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed relea...

CVE-2026-88264 Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations...

CVE-2026-88264 Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations...

CVE-2026-88264

crun , a container runtime, is affected by a /dev/console symlink-follow flaw (CVE-2026-88264). When the container configuration does not assign a dedicated mount to /dev, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fall...

CVE-2026-88288 GV-LPC2011/LPC2211 - Arbitrary File Read Through BKDownloadLink.cgi Symlink Creation

GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service...

CVE-2026-88288

GeoVision GV-LPC2211 (also listed as GV-LPC2011) version V1.13 is affected by an arbitrary file read vulnerability in the BKDownloadLink.cgi endpoint. The root cause is a failure to restrict the filename parameter supplied to the CGI script, which allows a remote user with valid web credentials t...

CVE-2025-63945-Tencent-iOA-EoP

CVE-2025-63945 Tencent iOA 権限昇格 バージョン : 210.9.28693.62001 より前 概要: Tencent PC Manager において、C:\Windows\Temp 配下のファイルとディレクトリが安全に処理されない脆弱性を発見しました。攻撃者はシンボリックリンク（symlink）攻撃を利用して、SYSTEM 権限のプロセスに任意のファイルを削除させ、ローカル権限昇格を引き起こす可能性があります。具体的には、「ioa」コンポーネントの使用時に、LegacyKBioawin.exe という名前のプロセスが定期的に起動されます。動作中、このプロセス...

CVE-2026-53613-poc

CVE-2026-53613 PoC mount8 における TOCTOU 脆弱性。ローカルでの権限昇格により root を取得できます。 影響を受けるバージョン util-linux 2.41.0 から 2.41.4 util-linux 2.42.0 から 2.42.1 エクスプロイト ファイル| 手法| ターゲット ---|---|--- exploitshell.sh| SSH 鍵の抽出| /root exploitdirectshell.sh| 直接シェル| /bin クイックスタート root@kitploit: 方法 1: SSH 鍵を抽出して root として SSH 接...

CVE-2026-64846

A flaw was found in Nix. A malicious derivation, when executed with the recursive-nix experimental feature enabled, can exploit a time-of-check/time-of-use TOCTOU race condition in the final symlink handling of the LocalStore restore path. This allows the Nix process or nix-daemon to create or...

Gogs <= 0.13.3 - Remote Code Execution

Gogs self-hosted Git service versions 0.13.3 and earlier contain a critical symlink bypass vulnerability that circumvents the fix for CVE-2024-55947. Authenticated users can exploit improper symbolic link handling in the PutContents API to overwrite files outside the repository by committing a...

Se7enSlip

🔒 Se7enSlip - 7-Zip 脆弱性スキャナー 7-Zip アーカイブにおける重大な CVE-2023-52169 シンボリックリンクトラバーサル脆弱性を実演・検出する、魅力的なインタラクティブ Web アプリケーションです。 ⚡ 機能 🎯 コア機能 ZIP アップロード＆解析 - ドラッグ＆ドロップまたはクリックで ZIP ファイルをアップロードし、包括的なセキュリティ解析を実行 リアルタイムスキャン - パストラバーサル、シンボリックリンク、悪意のあるエントリを検出する高度なパターン認識 詳細レポート - リスク評価と推奨事項を含むエグゼクティブレベルのレポート...

Fortinet_FortiClient_Exploit_CVE-2026-24018

Fortinet FortiClient エクスプロイト CVE-2026-24018 CVE-2026-24018 の完全動作エクスプロイト: Fortinet FortiClientLinux 7.4.0 から 7.4.4、FortiClientLinux 7.2.2 から 7.2.12 における UNIX シンボリックリンク（Symlink）追従の脆弱性により、ローカルの非特権ユーザーが権限を root に昇格させることができます。...

CVE-2026-31802

CVE-2026-31802: tar シンボリックリンクのパストラバーサル / 任意ファイル上書き 研究: Joshua van Rijswijk 説明 このリポジトリには、npm の tar パッケージ（node-tar）のバージョン = 7.5.10 に影響する高深刻度の脆弱性 CVE-2026-31802 に関する、私の概念実証と解説が含まれています。 tar は、C:../../../target.txt のようなドライブ相対...

Unity Linux 20.1070a Security Update: gzip (UTSA-2026-107043)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107043 advisory. GNU gzip contains a vulnerability in the gzexe utility related to insecure temporary file handling. When the mktemp utility is not available in the users PATH, gzexe...

Oracle Linux 8 : ELSA-2026-65832-0: / mrtg (ELSA-2026-658320)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-658320 advisory. 2.17.7-1.1 - Fix CVE-2026-72694: symlink-following chown in PID file handling Resolves: RHEL-236037 Tenable has extracted the preceding description block...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2026-118)

The version of containerd installed on the remote host is prior to 2.2.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-118 advisory. Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context.A...