evilarc

evilarc Propósito evilarc te permite crear un archivo zip que contiene archivos con caracteres de traversal de directorios en su ruta incrustada. La mayoría de los programas comerciales de zip winzip, etc. evitarán la extracción de archivos zip cuyas rutas incrustadas contengan caracteres de...

CVE-2025-8088

CVE-2025-8088 Herramienta Python para manejo seguro de archivos, conciencia de path traversal y extracción segura. Inspirado en CVE-2025-8088. Safe Archive Handling PoC Herramienta educativa de equipo azul inspirada en problemas de path traversal como CVE-2025-8088. Este script ayuda a detectar y...

EUVD-2026-92292

DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The specific flaw exists within the backup restoration mechanism, which fai...

CVE-2023-4220-HTB-PermX

Chamilo-LMS-CVE-2023-4220-Exploit Descripción Este exploit demuestra una vulnerabilidad de carga de archivos sin restricciones en Chamilo-LMS. La vulnerabilidad afecta la funcionalidad de carga de archivos grandes ubicada en: /main/inc/lib/javascript/bigupload/inc/bigUpload.php Versiones afectada...

CVE-2026-62278: Improper Limitation of a Pathname to a Restricted Directory

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs...

CVE-2026-18515

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked by Navigator configuration. This could allow attackers to upload files onto the system to places the Navigator support did not intend, but...

CVE-2026-18515

IBM i Navigator for i is vulnerable to improper path validation (CWE-22, Path Traversal), allowing a remote authenticated attacker to place files into locations in the file system that Navigator configuration intended to block. The impact is limited: the condition applies only if the user's profi...

CVE-2026-18515 IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked by Navigator configuration. This could allow attackers to upload files onto the system to places the Navigator support did not intend, but...

CVE-2026-18515 IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked by Navigator configuration. This could allow attackers to upload files onto the system to places the Navigator support did not intend, but...

EUVD-2026-77762

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked by Navigator configuration. This could allow attackers to upload files onto the system to places the Navigator support did not intend, but...

PT-2026-91394

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked by Navigator configuration. This could allow attackers to upload files onto the system to places the Navigator support did not intend, but...

USN-8708-1: sudo-rs vulnerability

It was discovered that sudo-rs incorrectly handled time-of-check vs time- of-use conditions in sudoedit. A local attacker with permission to edit specific files using sudoedit could use this issue to place files in arbitrary directories, and possibly escalate their privileges. This issue only...

USN-8708-1 rust-sudo-rs vulnerability

It was discovered that sudo-rs incorrectly handled time-of-check vs time- of-use conditions in sudoedit. A local attacker with permission to edit specific files using sudoedit could use this issue to place files in arbitrary directories, and possibly escalate their privileges. This issue only...

FreeBSD : security/sudo-rs -- sudoedit could circumvent /etc/sudoers restrictions (c0acdbac-a524-11f1-8039-589cfc103809)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c0acdbac-a524-11f1-8039-589cfc103809 advisory. Trifecta Tech Foundation reports: Users that are explicitly permitted to edit only specific files using...

security/sudo-rs -- sudoedit could circumvent /etc/sudoers restrictions

Trifecta Tech Foundation reports: Users that are explicitly permitted to edit only specific files using sudoedit, are still able to place files in arbitrary directories. This only affects systems where sudoedit is used to give very fine-grained edit permissions, which is not the default...

CVE-2026-65612

nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed,...

PT-2026-80562

scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations...

scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.

...

ALPINE-CVE-2026-59996

scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations...

AZL-92039 CVE-2026-59996 affecting package openssh for versions less than 9.8p1-9

scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations...