CVE-2025-32463

🚨 PoC: CVE-2025-32463 – Vulnerabilidad de escape de chroot en Sudo Una vulnerabilidad crítica que afecta a versiones de sudo 1.9.0 a 1.9.17p1 , permitiendo a los usuarios escapar de chroot y obtener acceso al sistema de archivos raíz real. 📌 Descripción CVE-2025-32463 es una vulnerabilidad de...

CVE-2025-32463-Sudo-Chroot-Escape

CVE-2025-32463-Sudo-Chroot-Escape Descripción Este repositorio contiene una Prueba de Concepto PoC basada en Python para CVE-2025-32463, una vulnerabilidad de escalada de privilegios local en las versiones de sudo 1.9.14 a 1.9.17. Cuando un usuario tiene privilegios de sudo para ejecutar un coman...

CVE-2025-32463

Referencia: https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chroot Ejecutar el PoC en un servidor Ubuntu 24.04.2 LTS con Sudo v1.9.15p5, utilizando un usuario sin privilegios y sin reglas de Sudo definidas, da como resultado un shell de root fuera del entorno con chroot...

CVE-2025-32463_Exploit

CVE-2025-32463Exploit 受危害版本 1.9.14 to 1.9.17 root@kitploit: bash run.sh 成功如下 root@kitploit: neko@aosc-neko205 CVE-2025-32463Exploit@main $ bash run.sh + CVE-2025-32463 Sudo chroot 漏洞复现脚本 正在创建临时工作目录... 工作目录已创建: /tmp/sudoexploit.nc0EjT 正在创建 C 语言 payload woot1337.c... 正在设置 chroot 环境和恶意的...

CVE-2025-32462-CVE-2025-32463-PoC-Lab

CVE-2025-32462 y CVE-2025-32463 – Laboratorio Avanzado de PoC Este repositorio proporciona un laboratorio basado en contenedores y un PoC detallado para dos vulnerabilidades críticas de sudo: CVE-2025-32462 – Omisión de la lógica de coincidencia de host de sudo -h CVE-2025-32463 – Escape de la...

onetwoseven-writeup

HTB OneTwoSeven — Full Walkthrough A complete, end-to-end walkthrough of OneTwoSeven , a retired HackTheBox Linux machine. The full chain: deterministic credential generation → symlink escape of an SFTP chroot → vim swap file recovery → SSH port-forwarding to a firewalled admin panel → bypass of...

openSUSE 16 Security Update : rsync (openSUSE-SU-2026:21650-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21650-1 advisory. - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784: Daemon...

OPENSUSE-SU-2026:21650-1 Security update for rsync

This update for rsync fixes the following issues: - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" bsc1269042. - CVE-2026-53785: --relative implied-parent...

SUSE-SU-2026:23253-1 Security update for rsync

This update for rsync fixes the following issues: - CVE-2026-53783: rrsync restricted-directory escape bsc1269041. - CVE-2026-53784: Daemon module-root chdir escape under "use chroot = no" bsc1269042. - CVE-2026-53785: --relative implied-parent creation escapes the destination tree bsc1269043. -...

SUSE SLES15 Security Update : rsync (SUSE-SU-2026:3634-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3634-1 advisory. - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784...

SUSE CVE-2026-53793

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

ALPINE-CVE-2026-53793

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

AZL-95798 CVE-2026-53793 affecting package rsync for versions less than 3.5.0-1

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

CVE-2026-53793 rsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot Mode

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

CVE-2026-53793

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper...

Linux Distros Unpatched Vulnerability : CVE-2026-55554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after...

CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

DEBIAN-CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

UBUNTU-CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...