CVE-2025-9074-Docker-Exploit

CVE-2025-9074 Docker 容器命令执行工具 一个功能强大的 Docker 远程 API 漏洞利用工具，用于 CVE-2025-9074 漏洞的安全研究和测试。 核心优势 ✅ 全自动容器生命周期管理 ：自动创建临时容器，操作完成后自动清理，不留痕迹 ✅ 智能路径处理 ：自动识别并转换 Windows 路径为 Docker 挂载格式 ✅ 全自动化操作流程 ：无需手动输入复杂命令，菜单式交互，一键完成文件操作 ✅ 跨平台兼容 ：完美支持 Windows 和 Linux 系统 部分功能效果图 功能特性 容器操作 查看运行中的容器 查看所有容器（包括停止的） 创建新容器 停止容器...

CVE-2025-9074-PoC-Bash

CVE-2025-9074-PoC-Bash El PoC original es: https://github.com/j3r1ch0123/CVE-2025-9074. Este es un nuevo PoC en bash, ya que no todos los contenedores Docker tienen python instalado, y principalmente debe ejecutarse desde dentro de un contenedor. Pasos Desde dentro del contenedor, use lo siguient...

AWS-SAM-CLI-Vulnerabilities

Vulnerabilidades de AWS SAM CLI CVE-2025-3047 y CVE-2025-3048 Este README proporciona un análisis detallado de dos vulnerabilidades de seguridad encontradas en la Interfaz de Línea de Comandos del Modelo de Aplicaciones Serverless de AWS AWS SAM CLI – CVE-2025-3047 y CVE-2025-3048 – junto con los...

CVE-2025-62878

CVE-2025-62878: Path Traversal en Local Path Provisioner Resumen Elemento| Valor ---|--- CVE ID| CVE-2025-62878 GHSA ID| GHSA-jr3w-9vfr-c746 Gravedad| Crítica CVSS 10.0 CWE| CWE-23 Recorrido de Ruta Relativa Componente Afectado| rancher/local-path-provisioner Versiones Afectadas| v0.0.27 v0.0.32...

CVE-2026-92958

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries e.g. require: builtin: '', '-fs', '-childprocess' , negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the built...

CVE-2026-92958 vm2 before 3.11.7 Denylist Bypass via fs/promises

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries e.g. require: builtin: '', '-fs', '-childprocess' , negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the built...

CVE-2026-92958 vm2 before 3.11.7 Denylist Bypass via fs/promises

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries e.g. require: builtin: '', '-fs', '-childprocess' , negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the built...

github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup

A flaw was found in the Moby container framework. A race condition occurs during the docker cp mount setup, which a malicious container can exploit. This vulnerability allows the container to redirect a bind mount target to an arbitrary path on the host system. Consequently, an attacker could...

EUVD-2025-210915

A flaw was found in Podman. If an attacker can pass a crafted tar archive to the podman load command, they can create files on the host machine with the privileges of the user running Podman...

docker-cve-2022-39253-poc

lectura del archivo host de docker usando cve-2022-39253 poc PoC reproducir entorno root@kitploit: $ docker run --name=cve-2022-39253 -ti -d ssst0n3/dockerarchive:gitcve-2022-39253 $ docker attach --detach-keys ctrl-x cve-2022-39253 use ctrl-x to exit container's terminal wait minutes for...

CVE-2026-77179

On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user,...

CVE-2026-5555-Container-Escape-via-proc-self-fd-Symlink-in-Shared-Volume

CVE-2026-5555 – Escape de contenedor mediante enlace simbólico /proc/self/fd Resumen Un volumen compartido montado con propagación rshared permite que un contenedor malicioso cree un enlace simbólico que apunte a un archivo del host a través de /proc/self/fd. El proceso del host que escribe en el...

poc-cve-2024-0132

poc-cve-2024-0132 Entorno de reproducción: os: ubuntu 22.04 with nvidia driver docker: v27.1.0 nvidia-container-toolkit: v1.16.1 Paso de reproducción: ejecutar la imagen del contenedor poc Objetivo: Acceder a archivos del host en el contenedor Llamar a las APIs del daemon de Docker a través del...

Astra Linux – Vulnerability in docker.io-app

Moby is an open-source container framework. In Docker Engine before version 29.5.1, Docker Daemon versions 28.5.2 and earlier, and Moby Daemon before version 2.0.0-beta.14, a race condition during the docker cp mount setup allowed a malicious container to redirect a bind mount target to an...

Astra Linux – Vulnerability in docker.io-app

BuildKit is a toolkit for converting source code into build artifacts in an efficient, expressive, and repeatable manner. A malicious BuildKit frontend or Dockerfile using RUN --mount could exploit a feature that removes empty files created for the mountpoints, causing the file to be removed from...

CVE-2025-9074

Description Vibe coded a small exploit script in pure Bash without dependencies on tools that might not be installed. The script talks to the internal Docker API, creates and starts a new container, mounts the host C drive and then executes a command inside that. The output is streamed back to th...

CVE-2026-90616

In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated to arbitrary code execution on the host, a different vulnerability than CVE-2026-76925. Flatpak creates a few app data directories e.g., /var/cache, /var/dat...

EUVD-2026-75564

There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. This vulnerability affects NI SystemLink and NI SystemLink Server 2026 Q3 and prior...

CVE-2026-4129

NI SystemLink and NI SystemLink Server (versions 2026 Q3 and prior) contain an improper access control vulnerability that allows an authenticated user with limited privileges to access host operating system files and directories that should be restricted. The CVSS 3.1 score is 8.1 (HIGH) with hig...

CVE-2026-88265

A flaw was found in crun. After pivotroot, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed relea...