CVE-2026-14361

CVE-2026-14361 Consul Template 的 writeToFile 辅助函数直接打开操作者提供的目标路径，并跟随被链接的路径组件，从而使渲染输出能够逃逸预期目录并覆盖已存在的文件。 简介 我在审查 HashiCorp Consul Template 时发现了这个问题，当时脑海中有一个直接的文件系统安全问题： 如果writeToFile 收到的路径看似位于预期目录之内，它是否会验证文件系统实际将数据写入何处？ 在本例中，答案是否定的。 writeToFile 模板辅助函数通过 os.Create 或 os.OpenFile 直接打开用户提供的最终路径。...

subpath-exploit

通过 CVE-2017-1002101 实现 Kubernetes 逃逸示例 描述 在了解到这个问题并参考此指南后，我想进一步探索。该仓库包含几个 Pod 部署和辅助 Shell 脚本，以最简单的方式演示了攻击机制，使 Kubernetes 管理员和运维人员能够充分理解其严重性和潜在风险。您必须是已认证用户，或者能够在创建 Pod 时控制其 spec/template，因此这种逃逸不太可能以匿名方式发生，除非与其他攻击（如这个）结合使用。 快速解释 当 Kubelet 挂载卷/密钥/配置映射等时，它会错误地跟随卷内部的符号链接，访问到本应限制范围之外的位置。由于 Kubelet 以 ro...

cve-2026-11837-ansible-posix-authorized-key

CVE-2026-11837: ansible.posix authorizedkey 本地权限提升 通过跟随符号链接的 chown（以及跟随符号链接的文件创建）对用户的 /.ssh 目录和 authorizedkeys 文件，在 ansible.posix.authorizedkey Ansible 模块中实现本地权限提升。 这是一份关于我报告的漏洞的书面说明，该漏洞已被红帽产品安全团队（CNA）分配为 CVE-2026-11837 。此处作为技术记录发布，而非声称具有新颖性：该问题是 CVE-2024-9902 的 同源问题 ，早期修复未覆盖到该模块。 官方参考 红帽 CVE...

CVE-2025-27591-Meta-below-LPE

CVE-2025-27591 — Meta below 符号链接本地权限提升 概述 字段| 详情 ---|--- CVE| CVE-2025-27591 软件| Meta below（系统资源监视器） 受影响版本| 前提条件： 当前用户必须拥有执行 /usr/bin/below 的 sudo 权限...

CVE-2026-53802

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

CVE-2026-85092

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

Fortinet_FortiClient_Exploit_CVE-2026-24018

Exploit de Fortinet FortiClient CVE-2026-24018 Exploit totalmente funcional para CVE-2026-24018: una vulnerabilidad de seguimiento de enlaces simbólicos Symlink de UNIX en Fortinet FortiClientLinux 7.4.0 hasta 7.4.4, FortiClientLinux 7.2.2 hasta 7.2.12 permite a un usuario local y sin privilegios...

CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-85092

LiME (Linux Memory Engine) through version 1.12.0 contains an arbitrary file overwrite vulnerability caused by a missing O_NOFOLLOW flag and insufficient validation of the operator-supplied disk acquisition output path. An unprivileged local attacker who controls the output directory can plant a ...

Dell PowerProtect Cyber Recovery < 20.3.0.0 Multiple Vulnerabilities (DSA-2026-370)

The version of Dell PowerProtect Cyber Recovery installed on the remote host is prior to 20.3.0.0. It is, therefore, affected by multiple vulnerabilities: - Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an SQL Command 'SQ...

GHSA-P498-V437-472G humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

Summary @humanfs/node does not treat symlinks as a separate case during copy operations. A symlink placed inside an attacker-controlled source tree can make copyAll read and copy the contents of any file readable by the process, even when that file is outside the directory being copied. Details T...

humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

Summary @humanfs/node does not treat symlinks as a separate case during copy operations. A symlink placed inside an attacker-controlled source tree can make copyAll read and copy the contents of any file readable by the process, even when that file is outside the directory being copied. Details T...

CVE-2026-D0cker

CVE-2026-Pending: 通过 runC maskPaths 漏洞实现容器逃逸 严重级别: 严重 CVSS 9.8 组件: opencontainers/runc libcontainer 漏洞类型: CWE-59: 在访问文件前未正确解析链接（'链接跟随'） 🚨 执行摘要 runc 的 maskPaths 函数存在一个严重漏洞。当在容器内屏蔽敏感路径（如 /proc/kcore）时，runc 使用了 os.OpenFilepath, OPATH, 0 但没有添加 ONOFOLLOW 标志。这允许恶意容器进程将目标路径替换为指向敏感主机文件（例如...

MiracleLinux 8 : abrt-2.10.9-26.el8_10.ML.1 (AXSA:2026-1725:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1725:01 advisory. abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories CVE-2026-54228 abrt: ChownProblemDir succeeds...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

Linux Distros Unpatched Vulnerability : CVE-2026-82252

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata...

Linux Distros Unpatched Vulnerability : CVE-2026-82248

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal...

CVE-2024-50404

CVE-2024-50404 https://www.qnap.com/en/security-advisory/qsa-24-48 https://www.cve.org/CVERecord?id=2024-50404 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N 6.8 “已报告一个链接跟随漏洞会影响 Qsync Central。若被利用，该漏洞可能允许已获得用户访问权限的远程攻击者遍历文件系统到非预期位置。” 发现日期： 2024年4月22日 修复日期： 2024年12月7日 受影响版本： Qsync...

CVE-2026-55569

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...