openstack-nova-compute: Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova

A flaw in OpenStack Nova’s interaction with the qemu-img utility allows an authenticated user to overwrite arbitrary files on the compute host. This occurs because Nova invokes qemu-img without strictly constraining the disk image format, enabling a malicious user to craft a QCOW2 header on a raw...

Gogs 0.13.3 Authenticated Symlink Write

Gogs versions 0.13.3 and earlier contain an authenticated symbolic link handling flaw in the PutContents API that can allow writes to service-account-accessible files and remote code execution. https://packetstorm.news/download/238905...

CVE-2019-1476

CVE-2019-1476 AppXSvc Arbitrary File Overwrite DoS I have independently reported this vulnerability to MSRC as part of my research inspired by CVE-2019-0841 originally reported by Nabeel Ahmed. This vulnerability allows a regular user to overwrite arbitrary files. However, the attacker's...

CVE-2024-37726-MSI-Center-Local-Privilege-Escalation

CVE-2024-37726 MSI Center Local Privilege Escalation - Arbitrary File Overwrite Vulnerability Vulnerability Summary A local privilege escalation vulnerability on Windows OS has been identified in MSI Center versions = 2.0.36.0, which allows a low-privileged user to arbitrarily overwrite or delete...

security-research

Security Research A collection of files related to my personal security research. Additional content will be posted on my blog https://blog.mirch.io. Tools Tool| Description ---|--- openssldircheck| Windows utility to check for potential insecure paths used by the OPENSSLDIR build parameter in...

Cve-2025-8088-WinRar-vulnerability

Cve-2025-8088 WinRAR Python tool that creates a malicious RAR file to exploit the CVE-2025-8088 vulnerability in WinRAR. The CVE-2025-8088 vulnerability allows exploitation of manipulated RAR files to cause path traversal and overwrite arbitrary files on the victim's system. This project is for...

Dirty-Pipe-CVE-2022-0847

Dirty-Pipe-CVE-2022-0847 CVE-2022-0847 Dirty Pipe is an arbitrary file overwrite vulnerability that allows escalation of privileges by modifying or overwriting arbitrary read-only files e.g. /etc/passwd, /etc/shadow. Steps 1. Compile using gcc cve-2022-0847-exploit.c -o cve-2022-0847-exploit 2. R...

CVE-2026-23745

CVE-2026-23745: node-tar Arbitrary File Overwrite Research: Joshua van Rijswijk Description PoC for CVE-2026-23745 , a high-severity path traversal vulnerability in node-tar 7.5.2. The library fails to sanitize absolute paths in the linkpath field for Hardlinks and Symlinks. This allows malicious...

CVE-2026-21436

CVE-2026-21436 eopkg = 4.3.4, the Solus OS package manager, writes files containing absolute paths in package contents directly to the specified directory during the installation of packages with the .eopkg extension. Even if the --destdir parameter, used to install the package to a specific...

CVE-2024-37726-MSI-Center-Local-Privilege-Escalation

CVE-2024-37726 MSI Center Local Privilege Escalation - Arbitrary File Overwrite Vulnerability...

CVE-2026-119291

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker who supplies an untrusted cloned repository,...

EUVD-2026-114137

Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker who supplies an untrusted cloned repository,...

CVE-2022-43293

Exploits for CVE-2022-43293 To get a persistent Windows Denial of Service as shown in the POC above, simply run Exploit.bat and enter %windir%\system32\cng.sys when you're asked which file you want to overwrite. Here you can find my Arbitrary File Write\Overwrite Vulnerability report. Here you ca...

CVE-2026-116271

A flaw was found in perl-mime-tools. This vulnerability allows a local attacker to overwrite arbitrary files with the permissions of the application process. When the parser writes message attachments into a shared or world-writable directory, an attacker can pre-create the expected output...

CVE-2026-77819

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory...

CVE-2026-77819 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory...

CVE-2026-77819: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to…

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory...

GHSA-M665-V7PM-7GRJ zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

Summary A critical architectural parser differential exists in the zip crate = 9.0.4 between random-access archive readers ZipArchive and streaming readers ZipStreamReader. ZipArchive considers the Central Directory File Header CDFH authoritative and ignores the filename declared in the Local Fil...

zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

Summary A critical architectural parser differential exists in the zip crate = 9.0.4 between random-access archive readers ZipArchive and streaming readers ZipStreamReader. ZipArchive considers the Central Directory File Header CDFH authoritative and ignores the filename declared in the Local Fil...

CVE-2026-103407 Session Smart Router and Session Smart Conductor: Unsanitized input allows arbitrary file read, overwrite, or deletion via the PKI management

An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the...