CVE-2025-3464-AsIO3-LPE

CVE-2025-3464-AsIO3-LPE CVE-2025-3464: 特権のないLPEエクスプロイト for ASUS AsIO3.sys - TOCTOU認証バイパス + PreviousModeデクリメント CVE-2025-3464: AsIO3.sys ローカル特権昇格 このエクスプロイトはWindows 11 22H2以前でのみ動作します。MicrosoftはPreviousModeの不正操作を修正しました。 ASUS AsIO3.sysドライバ向けのローカル特権昇格エクスプロイトです。NT AUTHORITY\SYSTEMを取得します。 概要...

CVE-2020-10665

CVE-2020-10665 Docker Desktop のローカル権限昇格 Docker Desktop のローカル権限昇格の POC。 https://www.activecyber.us/activelabs/docker-desktop-local-privilege-escalation-cve-2020-10665 の writeup に基づいて作成されました。 ハードリンクの作成は、https://github.com/googleprojectzero/symboliclink-testing-tools から流用しています。...

SharpPolarBear

SharpPolarBear This is a weaponized version for one of the Exploits published by SandboxEscaper from here https://github.com/SandboxEscaper/polarbearrepo. Most of the code comes from rasta-mouse CollectorService repository https://github.com/rasta-mouse/CollectorService. I just changed the...

CVE-2026-29786

CVE-2026-29786 研究: Joshua van Rijswijk 説明 このリポジトリには、CVE-2026-29786 の概念実証（PoC）が含まれています。これは tar npm パッケージの脆弱性であり、細工されたアーカイブによって、意図した展開ディレクトリの外を指すハードリンク を作成できるものです。 この問題は、tar アーカイブに C:../target.txt のようなドライブ相対リンクターゲット が含まれている場合に発生します。展開中にライブラリが検証とパス正規化を実行する順序が原因で、トラバーサル保護をバイパスできます。 正規化後、パスは...

research

セキュリティ研究 私が発見したセキュリティ脆弱性（CVE）に関するリポジトリです。本リポジトリには、発見した脆弱性の詳細な技術文書、概念実証（PoC）エクスプロイト、および分析が含まれています。 概要 本リポジトリは、私が発見・調査したすべてのCVEをまとめたもので、以下を含みます： 各脆弱性の詳細な技術分析 教育目的の概念実証（PoC）コード 攻撃シナリオと影響評価 修正状況とパッチ情報 公式CVEレコードへの参照 発見したCVE CVE-2026-26158 - BusyBox Hardlink Bypass 9.3 緊急 CVE-2026-26157 - BusyBox Path...

AlmaLinux 9.2 [TuxCare] Security Update: git / git-all / git-core / git-core-doc / git-credential-libsecret / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1739386567)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1739386567 advisory. - Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, local clones may e...

CentOS Linux 8.5 [TuxCare] Security Update: git / git-all / git-core / git-core-doc / git-credential-libsecret / etc (CENTOS8.5:CLSA-2026:1768393530)

The CentOS Linux 8.5 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.5:CLSA-2026:1768393530 advisory. - Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local source...

AlmaLinux 9.2 [TuxCare] Security Update: tar (ALMALINUX9.2:CLSA-2026:1789128477)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789128477 advisory. - A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designate...

AlmaLinux 9.6 [TuxCare] Security Update: tar (ALMALINUX9.6:CLSA-2026:1789131413)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789131413 advisory. - A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designate...

Rocky Linux 9.6 [TuxCare] Security Update: tar (ALMALINUX9.6:CLSA-2026:1789131413)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1789131413 advisory. - A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the...

python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...

python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

A flaw was found in the tarfile.extractall function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside th...

CentOS Linux 8 [TuxCare] Security Update: git / git-all / git-core / git-core-doc / git-credential-libsecret / etc (CENTOS-STREAM8:CLSA-2026:1768570231)

The CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1768570231 advisory. - Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, when cloning a local...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.2:CLSA-2026:1787311430)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787311430 advisory. - tarfile.extractall with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a...

CVE-2025-4517-POC

CVE-2025-4517 Exploit NOTES This exploit and description are written by AI. If you find a mistake or issue, please let me know! This exploit was tested and confirmed working. Thank you! Overview This exploit leverages CVE-2025-4517 , a critical vulnerability in Python's tarfile module that allows...

CVE-2025-55188

CVE-2025-55188: 7-Zip の任意ファイル書き込み CVE-2025-55188 7-Zip の任意ファイル書き込み の Proof-of-concept。2025年8月3日にリリースされたバージョン 25.01 で修正されました。 注: CVE-2025-55188 は CVE-2025-11001 とは異なります。 CVE-2025-11001 が修正されたバージョン バージョン 25.00 は、依然として脆弱です CVE-2025-55188 によるシンボリックリンク攻撃を介した任意コード実行に対して。 CVE-2025-55188 は、CVE-2025-11001...

CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

DEBIAN-CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...

CVE-2026-96279

A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from an OCI remote, allowing disclosure of arbitrary host file contents. For system-wide installs running as root, this includes sensitive files such as...