CVE-2026-14361

CVE-2026-14361 Le helper writeToFile de Consul Template ouvrait directement une destination fournie par l'opérateur et suivait les composants de chemin liés, permettant à la sortie rendue de s'échapper du répertoire prévu et d'écraser un fichier préexistant. Introduction J'ai trouvé ce problème e...

subpath-exploit

Пример ухода из Kubernetes через CVE-2017-1002101 Описание Узнав о проблеме и следуя этому руководству, я захотел изучить её подробнее. Этот репозиторий содержит несколько развёртываний подов и вспомогательные shell-скрипты, которые демонстрируют механизм атаки самым простым способом, чтобы...

libvirt: swtpm privilege escalation via symlink following

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

Important: Red Hat Security Advisory: virt:rhel security update

An update for the virt:rhel module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

libvirt: swtpm privilege escalation via symlink following

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

Fortinet_FortiClient_Exploit_CVE-2026-24018

Exploit Fortinet FortiClient CVE-2026-24018 Exploit entièrement fonctionnel pour CVE-2026-24018 : une vulnérabilité de suivi de lien symbolique Symlink UNIX dans Fortinet FortiClientLinux 7.4.0 à 7.4.4, FortiClientLinux 7.2.2 à 7.2.12 permet à un utilisateur local et non privilégié d'élever ses...

gortex-PoC

Suivi de liens symboliques dans le parcours de fichiers de l'indexeur → Divulgation de contenu hors dépôt via searchtext Statut CVE : demandé, en attente d'attribution. Cette découverte est publiée sous GHSA-6vhf-4wcm-2r83. À l'attribution de la CVE, ce dépôt sera renommé CVE-YYYY-NNNNN-gortex-Po...

CVE-2026-D0cker

CVE-2026-Pending: Container Escape via runC maskPaths Vulnérabilité Gravité : Critique CVSS 9.8 Composant : opencontainers/runc libcontainer Type de vulnérabilité : CWE-59 : Résolution incorrecte des liens avant l'accès aux fichiers 'Link Following' 🚨 Résumé Exécutif Une vulnérabilité critique...

MiracleLinux 8 : mrtg-2.17.7-1.el8_10.1 (AXSA:2026-1849:03)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1849:03 advisory. mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation CVE-2026-72694 Tenable has extracted the preceding...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

BIT-RCLONE-2026-88016 rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path...

rsync: rsync: Arbitrary File Read via Symlink Following

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

rsync: rsync: Local Privilege Escalation via Symlink Following

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...

rsync: rsync: Local Privilege Escalation via Symlink Following

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...

rsync: rsync: Arbitrary File Read via Symlink Following

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

OESA-2026-3832 libvirt security update

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes. The main package includes the libvirtd server exporting the virtualization support. Security Fixes: A flaw was found in libvirt. An unprivileged local user could exploit an integer...

Security update for libvirt

This update for libvirt fixes the following issues: CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow bsc1275863. CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection bsc1274576. CVE-2026-63622...

cve-2026-11837-ansible-posix-authorized-key

CVE-2026-11837 : escalade de privilèges locale avec authorizedkey de ansible.posix Escalade de privilèges locale dans le module Ansible ansible.posix.authorizedkey via chown suivant les liens symboliques et création de fichier suivant les liens symboliques sur le répertoire /.ssh d'un utilisateur...

ALSA-2026:67463 Important: rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fixes:...