Lucene search
+L

472 matches found

Kitploit
Kitploit
added 2026/09/02 6:19 p.m.5 views

CVE-2026-14361

CVE-2026-14361 Consul Template 的 writeToFile 辅助函数直接打开操作者提供的目标路径,并跟随被链接的路径组件,从而使渲染输出能够逃逸预期目录并覆盖已存在的文件。 简介 我在审查 HashiCorp Consul Template 时发现了这个问题,当时脑海中有一个直接的文件系统安全问题: 如果writeToFile 收到的路径看似位于预期目录之内,它是否会验证文件系统实际将数据写入何处? 在本例中,答案是否定的。 writeToFile 模板辅助函数通过 os.Create 或 os.OpenFile 直接打开用户提供的最终路径。...

4.7CVSS5.8AI score0.00133EPSS
SaveExploits1
Github Security Blog
Github Security Blog
added 2026/09/02 2:27 p.m.4 views

humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

Summary @humanfs/node does not treat symlinks as a separate case during copy operations. A symlink placed inside an attacker-controlled source tree can make copyAll read and copy the contents of any file readable by the process, even when that file is outside the directory being copied. Details T...

5.9AI score
SaveExploits0References4Affected Software1
Kitploit
Kitploit
added 2026/09/02 10:37 a.m.3 views

subpath-exploit

サンプルKubernetesエスケープ(CVE-2017-1002101経由) 説明 本問題について耳にし、このガイドを参考にした後、もう少し詳しく調べてみたいと思いました。このリポジトリには、攻撃メカニズムを可能な限り単純な方法で示すいくつかのPodデプロイメントと補助シェルスクリプトが含まれており、Kubernetes管理者や運用者が深刻さと潜在的なリスクを完全に理解できるようにしています。認証済みユーザーであるか、Podのspec/template作成時に制御できる必要があるため、このエスケープが匿名で行われる可能性は低く、このような他の攻撃と組み合わせなければ実現しません。...

9.6CVSS7.1AI score0.13267EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/01 10:06 a.m.8 views

CVE-2026-D0cker

CVE-2026-Pending: runC maskPaths 脆弱性によるコンテナエスケープ 深刻度: クリティカル CVSS 9.8 コンポーネント: opencontainers/runc libcontainer 脆弱性タイプ: CWE-59: ファイルアクセス前のリンク解決の不備 'Link Following' 🚨 エグゼクティブサマリー runc の maskPaths 関数に重大な脆弱性が存在します。コンテナ内の機密パス 例: /proc/kcore をマスクする際、runc は os.OpenFilepath, OPATH, 0 を ONOFOLLOW...

5.9AI score
SaveExploits0
RedHat Linux
RedHat Linux
added 2026/08/31 4:11 a.m.10 views

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

7.8CVSS7.2AI score0.00232EPSS
SaveExploits0References8
Kitploit
Kitploit
added 2026/08/30 2:25 p.m.7 views

CVE-2024-50404

CVE-2024-50404 https://www.qnap.com/en/security-advisory/qsa-24-48 https://www.cve.org/CVERecord?id=2024-50404 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N 6.8 "링크 추적link following 취약점이 Qsync Central에 영향을 미치는 것으로 보고되었습니다. 악용될 경우, 이 취약점으로 인해 사용자 접근 권한을 획득한 원격 공격자가 파일 시스템을 탐색하여...

8.8CVSS5.9AI score0.01394EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/08/29 7:33 a.m.5 views

cve-2026-11837-ansible-posix-authorized-key

CVE-2026-11837: escalatione dei privilegi locali in ansible.posix.authorizedkey Escalatione locale dei privilegi nel modulo Ansible ansible.posix.authorizedkey tramite chown che segue i collegamenti simbolici e creazione di file che segue i collegamenti sulla directory /.ssh e sul file...

7.3CVSS6.8AI score0.00259EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/08/29 2:17 a.m.8 views

CVE-2025-27591-Meta-below-LPE

CVE-2025-27591 — Meta below: escalation locale dei privilegi tramite symlink Panoramica Campo| Dettagli ---|--- CVE| CVE-2025-27591 Software| Meta below monitor delle risorse di sistema Versioni interessate| 0.9.0 Vulnerabilità| Follow di symlink → sovrascrittura arbitraria di file come root...

6.8CVSS6.8AI score0.00364EPSS
SaveExploits23References1
NVD
NVD
added 2026/08/28 8:18 p.m.9 views

CVE-2026-55569

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

6.6CVSS0.00142EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/28 4:26 p.m.32 views

CVE-2026-55569 aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

6.6CVSS0.00142EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/28 4:26 p.m.22 views

CVE-2026-55569

aqua (aquaproj/aqua), a declarative command-line version manager written in Go, contains a symlink traversal flaw in pkg/unarchive/archives.go (HandleFile). The handler calls os.Symlink with an unvalidated LinkTarget and does not jail the target to the extraction destination. A subsequent regular...

6.6CVSS5.9AI score0.00142EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/28 4:26 p.m.10 views

CVE-2026-55569 aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

6.6CVSS5.9AI score
SaveExploits0References5
CVE
CVE
added 2026/08/28 4:11 p.m.27 views

CVE-2026-55108

KubeVela 's Terraform remote configuration loader in pkg/controller/utils/capability.go (function GetTerraformConfigurationFromRemote) is vulnerable to denial of service. When a user with low privileges (ability to create or update ComponentDefinition objects) registers a Terraform remote schemat...

8.5CVSS5.9AI score0.00567EPSS
SaveExploits0References9
NVD
NVD
added 2026/08/28 12:16 p.m.10 views

CVE-2026-82248

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...

6CVSS0.00229EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/28 12:16 p.m.5 views

UBUNTU-CVE-2026-82252

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to pars...

8.7CVSS6AI score0.00387EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/08/28 12:16 p.m.9 views

CVE-2026-82248

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...

6CVSS5.9AI score0.00229EPSS
SaveExploits0References3
UbuntuCve
UbuntuCve
added 2026/08/28 12:16 p.m.8 views

CVE-2026-82252

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to pars...

8.7CVSS6AI score0.00387EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/28 10:49 a.m.23 views

CVE-2026-82252

gitoxide before 0.52.1 is vulnerable to a repository boundary violation via symlinked .gitmodules files. When reading the worktree .gitmodules file, gitoxide follows symlinks, allowing an attacker to create a malicious repository where .gitmodules points outside the repository tree. This causes g...

8.7CVSS6AI score0.00387EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/28 10:49 a.m.7 views

EUVD-2026-67704

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to pars...

8.7CVSS6AI score0.00387EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/28 10:49 a.m.8 views

EUVD-2026-67700

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...

6CVSS5.9AI score0.00229EPSS
SaveExploits0References2
Rows per page
Query Builder