POC-CopyEscape-CVE-2026-17106

CopyEscape — CVE-2026-17106 的 PoC 关于 CopyEscape （CVE-2026-17106）的教育性概念验证（PoC），这是 docker cp 中的一个 TOCTOU 竞态条件漏洞，允许恶意容器在 Docker 主机上写入任意文件。灵感来自 masasron 的原创研究，他在博客 "CopyEscape: Taking Over Docker Hosts with docker cp" 中发现了该漏洞并进行了记录。 目录 1. 执行摘要 2. 法律声明 3. 攻击链架构 4. 环境要求 5. 仓库结构 6. 快速使用指南 7. 漏洞利用验证 8...

CopyEscape-CVE-2026-17106

CopyEscape：利用 docker cp 接管 Docker 主机（CVE-2026-17106） 这是博客文章 CopyEscape：利用docker cp 接管 Docker 主机 — CVE-2026-17106 的概念验证（PoC）仓库。 CopyEscape 可让恶意运行的容器与 Docker 的归档生成器竞争，从而创建不一致的 tar 流。随后，存在漏洞的 Docker CLI 会在提取过程中跟随被植入的符号链接，并写入运行 docker cp 的用户所选本地目标之外的位置。 该仓库包含两个演示： macos/ 包含一个非破坏性的 Docker Desktop 演示，它...

CVE-2026-64824-PoC

CVE-2026-64824 — Home Assistant Core 备份-恢复 符号链接路径遍历 → RCE CVSS 8.4（严重） · GHSA-cwh8-w64c-4j5h · CWE-22 / CWE-59 TL;DR 经过身份验证的（管理员）攻击者上传精心构造的备份 tar 包。恢复路径使用 filter="fullytrusted" 解压内部的 homeassistant.tar.gz，并且只校验成员的 名称 — 从不校验 SYMTYPE 的 链接名 。指向绝对路径（例如 Python 的 site-packages/）的符号链接会被保留，因此随后写入的...

NodeJS-Tar-Symlink-Exploit-CVE-2026-29786

📦 CVE-2026-29786：Node.js Tar 符号链接漏洞 -yellow 📌 执行摘要 本仓库记录了针对 CVE-2026-29786 的研究，这是流行的 Node.js tar 包中发现的一个高危漏洞。该漏洞允许攻击者创建一个恶意 tar 归档文件，在解压时利用符号链接 覆盖预期解压目录之外的文件（路径遍历）。 🔍 技术分析 该漏洞存在于 tar 解压引擎验证文件路径的方式中。通过构造一个带有 type: 'symlink' 的头部，攻击者可以将链接指向敏感位置（例如 /etc/shadow 或应用程序配置文件），并在解压过程中随后覆盖该文件。 攻击机制： 1. 归档创建...

Tarmageddon-CVE-2025-62518-

Tarmageddon CVE-2025-62518 视频：https://youtu.be/EYBB4BHsp9E 仓库目录 vulnerable-extract 最小可重现示例，接受一个路径作为参数，并将该文件解压到 ./output malicious-payload 创建一个简单的 malicious.tar 归档，其中包含一些走私内容的示例，注释逐步骤和逐块解释了正在进行的操作 复现 使用提供的 reproduce 脚本 或手动操作 运行 malicious-payload 生成载荷 malicious.tar 将此文件传递给我们的 vulnerable-extract...

github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction

A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or...

npm-tar-path-traversal-scanner

CVE-2026-31802 — npm tar 路径遍历扫描器 检测存在 CVE-2026-31802 漏洞的 npm 软件包，该漏洞是 tar npm 软件包中的一个路径遍历漏洞，允许在归档解压过程中写入任意文件。 功能特性 扫描 package-lock.json 中的易受攻击的 tar 版本 检查 nodemodules 中已安装的易受攻击软件包 使用特制的 tar 归档测试解压行为 识别导致易受攻击 tar 的依赖链 支持批量扫描多个项目 生成 JSON/CSV 报告 提供修复建议 安装 root@kitploit: git clone...

Important: Red Hat Security Advisory: podman security update

An update for podman is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

ALSA-2026:70201 Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: podman: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint...

CVE-2025-4517-PoC

CVE-2025-4517-PoC CVE-2025-4517 是 Python tarfile 模块中的一个漏洞，允许在解压不受信任的 tar 归档文件时，在提取目录之外写入任意文件。该问题出现在使用 TarFile.extract 或 TarFile.extractall 并指定 filter="data" 或 filter="tar" 时，后者无法完全阻止通过精心构造的 tar 成员进行的路径遍历攻击。 Python 3.14 将默认提取过滤器更改为 "data"，因此依赖此默认值的应用程序也可能受到影响。虽然源代码分发的安装不受显著影响，但任何使用这些过滤器解压不受信任 tar...

GHSA-M37J-52J7-PJW7 oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir)

Summary The content/file.Store in oras-go v2 unpacks OCI layer tarballs when a descriptor carries io.deis.oras.content.unpack=true. The extraction routine validates symlink targets purely lexically filepath.Join and, for regular files placed directly at the extraction root, skips the parent-symli...

CVE-2026-85731

A flaw was found in oras-go, a Go library for managing OCI Open Container Initiative artifacts. A remote attacker can exploit a symlink-chain bypass vulnerability during tar extraction of OCI layers. This allows a malicious archive to create or overwrite any file writable by the process outside t...

CVE-2026-79705

A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not...

CVE-2026-79705

CVE-2026-79705 affects the buildah/copier Go package, which underpins podman cp operations. When the copier is used outside of Buildah by a non-root caller , a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destin...

CVE-2026-55828

qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or...

CVE-2026-79699

A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header e.g. victim/.wh. can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or...

EUVD-2026-78783

qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or...

CVE-2026-55828 qbee transport: Symlink-chain path traversal in tar extraction (one level outside destination)

qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or...

CVE-2026-55828

go.qbee.io/transport , a remote access transport protocol implementation, is affected by a symlink-chain path traversal in its extractTar routine prior to v1.26.25 . The root cause is that path validation is strictly lexical and does not account for on-disk symlinks created earlier during extract...

CVE-2026-55828 qbee transport: Symlink-chain path traversal in tar extraction (one level outside destination)

qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or...