8901 matches found
CVE-2026-32282 TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the ATSYMLINKNOFOLLOW flag, which Root.Chmod uses to...
CVE-2026-32282
CVE-2026-32282: Root.Chmod can follow symlinks out of the root on Linux. OpenSUSE advisories for go1.25 and go1.26 include this CVE and patch Go to go1.25.9 or go1.26.2 respectively. Impact is limited to cases where a symlink is substituted after an initial check but before the chmod operation; e...
Linux Distros Unpatched Vulnerability : CVE-2026-39860
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix...
PT-2026-38563
Name of the Vulnerable Software and Affected Versions Go affected versions not specified Description The "go bug" command writes to two files with predictable names in the system temporary directory, such as "/tmp". An attacker with access to this directory can create a symbolic link symlink—a fi...
Time-of-check Time-of-use (TOCTOU) Race Condition
Overview std/internal/syscall/unix is a Go standard library package std/internal/syscall/unix Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition. Go Vulnerability Report:On Linux, if the target of Root.Chmod is replaced with a symlink while the chm...
Security Bulletin: TOCTOU Symlink Vulnerability in filelock, affects watsonx.data
Summary filelock versions prior to 3.20.1 are vulnerable to a Time-of-Check-Time-of-Use TOCTOU race condition. Local attackers can exploit this via symlinks to corrupt or truncate arbitrary files during lock creation on Unix, Linux, macOS, and Windows. The issue is fixed in version 3.20.1; partia...
EUVD-2025-209253
IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack...
CVE-2025-13044
IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack...
CVE-2025-13044
IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack...
CVE-2025-13044 Multiple Vulnerabilities in IBM Concert Software
IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack...
CVE-2025-13044
IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack...
CVE-2025-13044
CVE-2025-13044 affects IBM Concert Software versions 1.0.0–2.2.0. The issue arises from creating temporary files with predictable names, enabling a local user to overwrite arbitrary files via a symlink attack. The Red Hat/ENISA/NVD entries confirm the same description and the IBM Security Bulleti...
CVE-2025-13044 Multiple Vulnerabilities in IBM Concert Software
IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack...
PT-2026-30756
IBM Concert 1.0.0 through 2.2.0 creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack...
CVE-2026-27456
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU Time-of-Check-Time-of-Use vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privilege...
EUVD-2026-18864
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU Time-of-Check-Time-of-Use vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privilege...
CVE-2026-27456 util-linux: TOCTOU Race Condition in util-linux mount(8) - Loop Device Setup
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU Time-of-Check-Time-of-Use vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privilege...
CVE-2026-27456
util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU Time-of-Check-Time-of-Use vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privilege...
ONNX: TOCTOU arbitrary file read/write in save_external_dat
Summary The saveexternaldata method seems to include multiple issues introducing a local TOCTOU vulnerability, an arbitrary file read/write on any system. It potentially includes a path validation bypass on Windows systems. Regarding the TOCTOU, an attacker seems to be able to overwrite victim's...