CVE-2025-27591

CVE-2025-27591 – Privilege Escalation via Symlink Abuse in below 🛑 Disclaimer : This exploit is provided for educational and authorized security testing only. Unauthorized use may be illegal. 🧠 Overview below is a performance monitoring tool developed by Facebook for Linux systems. Versions of...

EUVD-2026-119290

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate the data area in SMB2read SMB2read copies le32tocpursp-DataLength bytes from char rsp + rsp-DataOffset without checking that the range lies within the response actually received. A READ response with...

RegPwnBOF

RegPwn BOF Cobalt Strike BOF port of the RegPwn exploit by Filip Dragovic @Wh04m1001 / MDSec ActiveBreach. This is a sloppy BOF reimplementation of the original C exploit. All credit for the vulnerability research and exploit goes to Filip Dragovic and MDSec. Blog post :...

Ghost-5.58-Arbitrary-File-Read-CVE-2023-40028

Ghost Arbitrary File Read Exploit CVE-2023-40028 Overview This script exploits a vulnerability in Ghost CMS CVE-2023-40028 to read arbitrary files from the server. By leveraging a symlink in an uploaded ZIP file, an attacker can gain unauthorized access to sensitive files on the system. Features ...

CVE-2025-27591

CVE-2025-27591 introduction below versions v0.9.0 are vulnerable to a local privilege escalation vulnerability duo to the fact that the program creates a world-writable log file, an a world writable log file instead, the attacker can replace the log file with a symblink to any system-critical fil...

Vite Dev Server - Path Traversal

Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the public directory were served bypassing the server.fs settings. Only apps that explicitly expose the Vite dev server to the network using --host or...

LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image

Reported from https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details Incus validates an image as soon as it sees a normal...

LXD has arbitrary file read+write on host via templates/ symlink in malicious image

Reported from https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479 Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details For container images, internal/server/storage/utils.go cal...

GHSA-JPF8-86F3-WP38 LXD has arbitrary file read+write on host via templates/ symlink in malicious image

Reported from https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479 Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details For container images, internal/server/storage/utils.go cal...

LXD has arbitrary file write on host via `exec-output` symlink in crafted image

Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv Summary The record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If exec-output is a symlink, file named execUUID.stdout and...

GHSA-9J25-MM2H-2F76 LXD has arbitrary file write on host via `exec-output` symlink in crafted image

Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv Summary The record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If exec-output is a symlink, file named execUUID.stdout and...

CVE-2026-108262

The open-source local web development tool DDEV (versions 1.25.2 through 1.25.4) contains a vulnerability in the Untar function located in pkg/archive/archive.go. The root cause is that while the system validates absolute tar symlink targets after rebasing them, it creates the symlink using the r...

EUVD-2026-118403

DDEV is an open-source tool for running local web development environments for PHP and Node.js. From 1.25.2 until 1.25.4, Untar in pkg/archive/archive.go validates an absolute tar symlink target after rebasing it beneath dest, but creates the symlink with the raw absolute Linkname. A crafted...

CVE-2026-123962

In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorizedkeys file to be a symlink. NOTE: FreedomBox is a Debian Pure Blend, which means that it distributes its software through Debian repositories...

EUVD-2026-118380

In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorizedkeys file to be a symlink. NOTE: FreedomBox is a Debian Pure Blend, which means that it distributes its software through Debian repositories...

CVE-2026-123962

In FreedomBox versions prior to 26.15 , unprivileged user accounts can perform unauthorized read and write operations on files they lack permissions for. The root cause is a symlink vulnerability (CWE-61) where a user can set the authorized_keys file as a symbolic link. No specific exploit code o...

CVE-2026-123962

In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorizedkeys file to be a symlink. NOTE: FreedomBox is a Debian Pure Blend, which means that it distributes its software through Debian repositories...

cockpit-files security update

An update is available for cockpit-files. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list A filesystem browser for Cockpit Security Fixes: cockpit-files:...

Security update for flatpak

This update for flatpak fixes the following issues: CVE-2026-34078: Arbitrary code execution via crafted symlinks in sandbox-expose options bsc1261769. CVE-2026-34079: Arbitrary file deletion on host via improper cache file path validation bsc1261770. CVE-2026-90616: missing symlink protection...

DEBIAN-CVE-2026-123037

A flaw was found in the ansible-core user module. When generatesshkey is enabled, User.sshkeygen guards the key files against symlinks but checks the /.ssh directory only with os.path.exists. An unprivileged user on a managed node who replaces their /.ssh with a symlink to an existing root-writab...