CVE-2026-14361

CVE-2026-14361 Consul Template의 writeToFile 헬퍼는 운영자가 지정한 대상을 직접 열고 연결된 경로 구성 요소를 따르므로, 렌더링된 출력이 의도된 디렉터리를 벗어나 기존 파일을 덮어쓸 수 있습니다. 소개 저는 HashiCorp Consul Template 을 검토하면서 다음과 같은 직접적인 파일시스템 보안 질문을 염두에 두고 이 문제를 발견했습니다: writeToFile이 의도된 디렉터리 안에 있는 것처럼 보이는 경로를 받으면, 파일시스템이 실제로 데이터를 기록할 위치를 검증합니까? 이 경우, ...

subpath-exploit

샘플 Kubernetes 탈출 - CVE-2017-1002101 이용 설명 이 문제에 대해 듣고 이 가이드를 따라가면서, 좀 더 탐구해보고 싶었습니다. 이 리포지토리는 몇 가지 파드 배포와 헬퍼 셸 스크립트를 포함하여, 쿠버네티스 관리자와 운영자가 심각성과 잠재적 위험을 완전히 이해할 수 있도록 공격 메커니즘을 가장 간단한 방식으로 보여줍니다. 인증된 사용자이거나 파드의 스펙/템플릿을 생성 시 제어할 수 있어야 하므로, 이 탈출은 다른 공격예: 이것과 결합하지 않으면 익명으로 이루어지지 않을 가능성이 높습니다. 빠른 설명...

CVE-2026-85092

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

Fortinet_FortiClient_Exploit_CVE-2026-24018

Fortinet FortiClient エクスプロイト CVE-2026-24018 CVE-2026-24018 の完全動作エクスプロイト: Fortinet FortiClientLinux 7.4.0 から 7.4.4、FortiClientLinux 7.2.2 から 7.2.12 における UNIX シンボリックリンク（Symlink）追従の脆弱性により、ローカルの非特権ユーザーが権限を root に昇格させることができます。...

CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-85092

LiME (Linux Memory Engine) through version 1.12.0 contains an arbitrary file overwrite vulnerability caused by a missing O_NOFOLLOW flag and insufficient validation of the operator-supplied disk acquisition output path. An unprivileged local attacker who controls the output directory can plant a ...

humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

Summary @humanfs/node does not treat symlinks as a separate case during copy operations. A symlink placed inside an attacker-controlled source tree can make copyAll read and copy the contents of any file readable by the process, even when that file is outside the directory being copied. Details T...

CVE-2026-D0cker

CVE-2026-Pending: runC maskPaths 취약점을 통한 컨테이너 탈출 심각도: 치명적 CVSS 9.8 구성 요소: opencontainers/runc libcontainer 취약점 유형: CWE-59: 파일 접근 전 부적절한 링크 확인'Link Following' 🚨 핵심 요약 runc의 maskPaths 함수에 치명적인 취약점이 존재합니다. 컨테이너 내부에서 민감한 경로예: /proc/kcore를 마스킹할 때, runc는 ONOFOLLOW 플래그 없이 os.OpenFilepath, OPATH, 0을 사용합니...

MiracleLinux 8 : abrt-2.10.9-26.el8_10.ML.1 (AXSA:2026-1725:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1725:01 advisory. abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories CVE-2026-54228 abrt: ChownProblemDir succeeds...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

Linux Distros Unpatched Vulnerability : CVE-2026-82252

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata...

Linux Distros Unpatched Vulnerability : CVE-2026-82248

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal...

CVE-2024-50404

CVE-2024-50404 https://www.qnap.com/en/security-advisory/qsa-24-48 https://www.cve.org/CVERecord?id=2024-50404 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N 6.8 "링크 추적link following 취약점이 Qsync Central에 영향을 미치는 것으로 보고되었습니다. 악용될 경우, 이 취약점으로 인해 사용자 접근 권한을 획득한 원격 공격자가 파일 시스템을 탐색하여...

cve-2026-11837-ansible-posix-authorized-key

CVE-2026-11837: escalatione dei privilegi locali in ansible.posix.authorizedkey Escalatione locale dei privilegi nel modulo Ansible ansible.posix.authorizedkey tramite chown che segue i collegamenti simbolici e creazione di file che segue i collegamenti sulla directory /.ssh e sul file...

CVE-2025-27591-Meta-below-LPE

CVE-2025-27591 — Meta below: escalation locale dei privilegi tramite symlink Panoramica Campo| Dettagli ---|--- CVE| CVE-2025-27591 Software| Meta below monitor delle risorse di sistema Versioni interessate| 0.9.0 Vulnerabilità| Follow di symlink → sovrascrittura arbitraria di file come root...

CVE-2026-55569

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

CVE-2026-55569 aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

CVE-2026-55569

aqua (aquaproj/aqua), a declarative command-line version manager written in Go, contains a symlink traversal flaw in pkg/unarchive/archives.go (HandleFile). The handler calls os.Symlink with an unvalidated LinkTarget and does not jail the target to the extraction destination. A subsequent regular...

CVE-2026-55569 aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...