CVE-2026-31802

🛡️ CVE-2026-31802 - 简易概念验证查看器 📋 关于 CVE-2026-31802 本仓库提供了 CVE-2026-31802 的概念验证 PoC 及分析报告。该问题存在于 npm tar 包中，是一个安全漏洞。攻击者可通过滥用符号链接和路径遍历，欺骗软件将文件写入其允许文件夹之外的位置。 这可能导致未经授权覆盖您计算机上的重要文件。了解并测试此漏洞有助于提升安全性。本项目展示了该漏洞的工作原理，并帮助安全研究人员验证修复方案。 🖥️ 系统要求 要在 Windows 机器上运行本软件，请确保系统满足以下条件： Windows 10 或更高版本 至少 2 GB 的可用硬盘空间...

CVE-2025-8110-Gogs-RCE-Exploit

Exploit RCE de CVE-2025-8110 en Gogs Un exploit automatizado en Python para CVE-2025-8110 en Gogs. Esta vulnerabilidad permite la Ejecución Remota de Código RCE abusando de la API PutContents, que no valida si una ruta de archivo es un enlace simbólico. Sobrescribiendo el archivo interno...

CVE-2025-27591

CVE-2025-27591 – below 中通过符号链接滥用的权限提升 🛑 免责声明 ：本利用程序仅供教育和授权的安全测试使用 。未经授权使用可能违法。 🧠 概述 below 是 Facebook 为 Linux 系统开发的一款性能监控工具。在修补版本发布之前的部分 below 版本存在一个严重漏洞，该漏洞通过利用全局可写日志目录 和未经过滤的日志处理，允许非特权用户 提升权限至 root 。 🔎 CVE 详情 字段| 值 ---|--- CVE-ID| CVE-2025-27591 严重性| 🔥 严重 CVSS ≈ 7.8 - 8.8 攻击向量| 本地 影响| 权限提升至 root...

litespeed-cpanel-cve-2026-54420-fix

CVE-2026-54420 缓解工具包 面向 CVE-2026-54420 的防御性修复、审计和验证工具包，该漏洞影响使用 CloudLinux / CageFS 的共享主机环境中的 LiteSpeed cPanel 插件 。 ⚠️ 安全声明 本仓库仅面向系统管理员、托管服务提供商以及防御性安全研究人员 。 不包含任何利用代码、攻击性工具或武器化概念验证。 关于 CVE-2026-54420 CVE-2026-54420 影响某些版本的 LiteSpeed cPanel 插件 / WHM 插件 ，在共享主机环境中可能导致符号链接处理被滥用。 在易受攻击的配置下，低权限用户（例如通过受感染...

Astra Linux – Vulnerability in php-pear

In ArchiveTar version 1.4.11, the Tar.php script allows write operations involving directory traversal, due to insufficient checking of symbolic links. This issue is related to CVE-2020-28948...

CVE-2026-65010 Datasets Symlink-following Arbitrary File Write via Extractor.extract()

Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extraction to arbitrary filesystem locations in...

CVE-2026-16552

Removed by vendor...

acl: Symlink traversal privilege escalation via libacl functions

A flaw was found in the acl package, specifically within its libacl pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list ACL read or write operations to...

CVE-2026-64615

Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without OEXCL or ONOFOLLOW. The segment is created in graph.h with openpath, ORDWR|OCREAT, 0666. The mode is 0666, so under the default umask 022 the file is created mode 0644 world-readable...

CVE-2026-65067

CVE-2026-65067 affects Data::Intern::Shared prior to 0.02 for Perl. The code creates a world-readable mmap backing file via open(path, O_RDWR|O_CREAT, 0666) with mode 0666, which becomes 0644 under the default umask. Absence of O_NOFOLLOW means a symlink at the path is followed, and absence of O_...

EUVD-2026-45941

A flaw was found in the QEMU Guest Agent qga. A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use TOCTOU...

Exploit for Path Traversal in Gogs

Gogs Arbitrary File Write to RCE CVE-2025-8110 - Exploit de...

Linuxfabrik Monitoring Plugins allow insecure creation of SQLite databases

SummaryThe SQLite databases are created at predictable static paths in /tmp. Any user can therefore create a symlink at these paths in /tmp pointing to arbitrary files. The monitoring scripts then follows these symlinks and then creates their database at the symlink target.This becomes really...

CVE-2026-14904

AWS Research and Engineering Studio RES is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS. Improper link resolution before file access issue CWE-59 in the Auth.GetUserPrivateKey API. An authenticated remot...

EUVD-2026-42056

AWS Research and Engineering Studio RES is an open-source solution that enables researchers and engineers to create and manage secure virtual desktops and computing resources on AWS. Improper link resolution before file access issue CWE-59 in the Auth.GetUserPrivateKey API. An authenticated remot...

CVE-2026-59195

CVE-2026-59195 affects pnpm prior to versions 10.34.4 and 11.8.0. The issue arises when pnpm reads package names from the env lockfile’s configDependencies section and uses those names directly to create config dependency symlinks under node_modules/.pnpm-config. A crafted pnpm-lock.yaml with a t...

CVE-2026-46406

Claude Code is an agentic coding tool. From 2.1.59 until 2.1.128, the Claude Code /copy command wrote responses to a hardcoded, predictable path /tmp/claude/response.md without UID isolation, randomness, or symlink protection. The file was created world-readable 0644 in a world-traversable...

GHSA-RHQ6-9RGH-V45C Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server container

In wings/internal/ufs/fsunix.go line 92-94, this function is defined and is used to change permissions of files in the server: go func fs UnixFS fchmodatop string, dirfd int, name string, mode FileMode error return ensurePathErrorunix.Fchmodatdirfd, name, uint32mode, 0, op, name This call to the...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via a crafted symlink in the templates directory during image import or instance backup restoration processes. An attacker can access and modify arbitrary files on the host system, potentially leadi...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path through the record-output process. An attacker can create or overwrite files on the host system by exploiting a crafted symlink in a container image, which can lead to arbitrary command execution...