subpath-exploit

Ejemplo de Escape de Kubernetes mediante CVE-2017-1002101 Descripción Después de conocer el problema y seguir esta guía, quise explorar un poco más. Este repositorio contiene un par de despliegues de pods y scripts auxiliares de shell que demuestran el mecanismo de ataque de la manera más simple...

CVE-2026-14361

CVE-2026-14361 Consul Template 的 writeToFile 辅助函数直接打开操作者提供的目标路径，并跟随被链接的路径组件，从而使渲染输出能够逃逸预期目录并覆盖已存在的文件。 简介 我在审查 HashiCorp Consul Template 时发现了这个问题，当时脑海中有一个直接的文件系统安全问题： 如果writeToFile 收到的路径看似位于预期目录之内，它是否会验证文件系统实际将数据写入何处？ 在本例中，答案是否定的。 writeToFile 模板辅助函数通过 os.Create 或 os.OpenFile 直接打开用户提供的最终路径。...

CVE-2026-77159

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

EUVD-2026-76070

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

CVE-2026-77159 Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

EUVD-2026-76034

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

CVE-2026-77159

A symlink-following flaw in libvirt's qemuTPMEmulatorPrepareHost() function performs a path-based chown() on the swtpm log file without validating for symbolic links. A local attacker with access to the swtpm account can replace the log file with a symlink, causing the root-level libvirtd daemon ...

CVE-2026-77159

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

Linux Distros Unpatched Vulnerability : CVE-2026-88016

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with...

GHSA-F8G7-2XJC-7MFH rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

Summary With -l/--links, rclone's local backend recreates a source .rclonelink object as a real symlink at the destination verbatim preserved by design for faithful backups. Directory-metadata application, however, does not go through the os.Root sandbox and does not use NOFOLLOW syscalls. A loca...

CVE-2026-68488

A Time-of-check Time-of-use TOCTOU race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover...

EUVD-2026-75594

A Time-of-check Time-of-use TOCTOU race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover...

CVE-2026-68488

A Time-of-check Time-of-use TOCTOU race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover...

CVE-2026-68488

CVE-2026-68488 is a TOCTOU race condition in Plesk's Backup Manager that leads to insecure symlink following during restore operations. An attacker with low privileges can exploit this to take over ownership of arbitrary files or directories, resulting in local privilege escalation to root . The ...

DEBIAN-CVE-2026-88016

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path...

CVE-2026-88016

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path...

gortex-PoC

索引器文件遍历中的符号链接跟随 → 通过 searchtext 泄露仓库外内容 CVE 状态： 已申请，待分配。此发现已发布为 GHSA-6vhf-4wcm-2r83。在 CVE 分配后，本仓库将重命名为 CVE-YYYY-NNNNN-gortex-PoC，且此横幅将替换为 CVE 链接。 | ---|--- 研究员| Dostxodjayev Abdullox @squeeze440 安全公告| GHSA-6vhf-4wcm-2r83 CVSS 3.1| 5.5 中危 弱点| CWE-59, CWE-200 索引器文件遍历中的符号链接跟随 → 通过 searchtext 泄露仓库外内容...

CVE-2026-88265

A flaw was found in crun. After pivotroot, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed relea...

CVE-2026-88265

A flaw was found in crun. After pivotroot, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed relea...

Fortinet_FortiClient_Exploit_CVE-2026-24018

Fortinet FortiClient 漏洞利用 CVE-2026-24018 针对 CVE-2026-24018 的完整可用漏洞利用：Fortinet FortiClientLinux 7.4.0 至 7.4.4、FortiClientLinux 7.2.2 至 7.2.12 中存在 UNIX 符号链接（Symlink）跟随漏洞，可导致本地非特权用户将其权限提升至 root。 https://github.com/user-attachments/assets/ba55bae6-acea-4391-a568-f5e44089a284...