9289 matches found
CVE-2026-50558: Improper Limitation of a Pathname to a Restricted Directory
Penelope Shell Handler is a post-exploitation shell handler for authorized security testing. Prior to 0.20.0, the Unix download implementation in penelope.py used tar.extractalllocaldownloadfolder on tar archives returned by remote sessions without validating member paths, allowing a malicious or...
PT-2026-65778
Name of the Vulnerable Software and Affected Versions GNU Bison version 3.8.2 Description GNU Bison improperly handles grammar-defined output paths. Grammar directives such as %output and %header allow specifying file paths that are accepted without restriction and override caller-supplied output...
CVE-2026-13723: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in the zipx.Unzip extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical e.g.,...
CVE-2026-65891: Improper Input Validation
Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor JCE 2.20.2 - Improper input validation in the file rename functionality allowed an authenticated user with file management permissions to rename files t...
Arbitrary File Overwrite in Develar app-builder (zipx.Unzip) via Symlink Following on macOS (APFS)
Overview A vulnerability in the zipx.Unzip extraction routine of Develar’s app-builder allows an attacker to overwrite arbitrary files on macOS using Apple File System APFS. The issue arises from a combination of Unicode normalization collisions and unsafe symlink-following behavior. APFS treats...
CVE-2026-64863: Improper Access Control
goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issu...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a security bypass in python-dotenv [CVE-2026-28684]
Summary IBM Watson Speech Services Cartridge is vulnerable to a security bypass in python-dotenv, due to a flaw allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. CVE-2026-28684. Python-dotenv is used in our speech...
CVE-2026-65010
A flaw was found in Hugging Face Datasets through 5.00 in Extractor.extract. When archive contents are extracted to predictable output paths, the extractor follows pre-planted symlinks instead of confining writes to the intended directory. A local attacker who can place those symlinks can redirec...
CVE-64600-Refluxfs-POC
RefluXFS CVE-64600 PoC This repo contains a PoC of the rec...
CVE-2026-64399
In the Linux kernel, the following vulnerability has been resolved: ksmbd: add permission checks for FSCTLDUPLICATEEXTENTSTOFILE The FSCTLDUPLICATEEXTENTSTOFILE arm of smb2ioctl overwrites the destination file's data via vfsclonefilerange with neither the share-level KSMBDTREECONNFLAGWRITABLE che...
GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
Summary Diffable.diff forwards kwargs straight into diff/difftree with no checkunsafeoptions guard. Diffable is mixed into Commit, Tree, IndexFile, and Submodule, giving a broad surface. git diff --output= writes real patch content to an attacker-chosen path, enabling arbitrary file overwrite. Ro...
GHSA-FJR4-X663-MWXC GitPython: Arbitrary file overwrite via git diff --output argument injection in Diffable.diff (key- and value-controlled)
Summary Diffable.diff forwards kwargs straight into diff/difftree with no checkunsafeoptions guard. Diffable is mixed into Commit, Tree, IndexFile, and Submodule, giving a broad surface. git diff --output= writes real patch content to an attacker-chosen path, enabling arbitrary file overwrite. Ro...
CVE-2026-65010
Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extraction to arbitrary filesystem locations in...
JLSEC-2026-779
A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue...
OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image
OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image...
PYSEC-2026-3470 OpenStack Ironic allows file overwrite via directory traversal during deployment with a crafted ISO image
OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image...
PT-2026-64081
OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image...
CVE-2026-16552
The CVE-2026-16552 entries describe a vulnerability in systemd-tmpfiles: when processing tmpfiles.d entries that write to a file, an unprivileged local user can cause systemd-tmpfiles to follow a symbolic link, potentially redirecting a privileged write to an attacker-controlled file. The highest...
PT-2026-71452
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.1.54 Description An arbitrary file overwrite issue exists in the Diffable.diff method due to insufficient validation of git options passed through kwargs. An attacker can use the --output argument via the other...