CVE-2026-14361

CVE-2026-14361 Consul Template's writeToFile helper opened an operator-supplied destination directly and followed linked path components, allowing rendered output to escape the intended directory and overwrite a preexisting file. Intro I found this issue while reviewing HashiCorp Consul Template ...

humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

Summary @humanfs/node does not treat symlinks as a separate case during copy operations. A symlink placed inside an attacker-controlled source tree can make copyAll read and copy the contents of any file readable by the process, even when that file is outside the directory being copied. Details T...

subpath-exploit

サンプルKubernetesエスケープ（CVE-2017-1002101経由） 説明 本問題について耳にし、このガイドを参考にした後、もう少し詳しく調べてみたいと思いました。このリポジトリには、攻撃メカニズムを可能な限り単純な方法で示すいくつかのPodデプロイメントと補助シェルスクリプトが含まれており、Kubernetes管理者や運用者が深刻さと潜在的なリスクを完全に理解できるようにしています。認証済みユーザーであるか、Podのspec/template作成時に制御できる必要があるため、このエスケープが匿名で行われる可能性は低く、このような他の攻撃と組み合わせなければ実現しません。...

CVE-2026-D0cker

CVE-2026-Pending: Container Escape via runC maskPaths Vunlerability Severity: Critical CVSS 9.8 Component: opencontainers/runc libcontainer Vulnerability Type: CWE-59: Improper Link Resolution Before File Access 'Link Following' 🚨 Executive Summary A critical vulnerability exists in runc's...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

CVE-2026-82248

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...

CVE-2024-50404

CVE-2024-50404 https://www.qnap.com/en/security-advisory/qsa-24-48 https://www.cve.org/CVERecord?id=2024-50404 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N 6.8 "Se ha informado de una vulnerabilidad de seguimiento de enlaces que afecta a Qsync Central. Si se explota, la...

cve-2026-11837-ansible-posix-authorized-key

CVE-2026-11837: escalatione dei privilegi locali in ansible.posix.authorizedkey Escalatione locale dei privilegi nel modulo Ansible ansible.posix.authorizedkey tramite chown che segue i collegamenti simbolici e creazione di file che segue i collegamenti sulla directory /.ssh e sul file...

CVE-2025-27591-Meta-below-LPE

CVE-2025-27591 — Meta below: escalation locale dei privilegi tramite symlink Panoramica Campo| Dettagli ---|--- CVE| CVE-2025-27591 Software| Meta below monitor delle risorse di sistema Versioni interessate| 0.9.0 Vulnerabilità| Follow di symlink → sovrascrittura arbitraria di file come root...

CVE-2026-55569

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

CVE-2026-55569 aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

CVE-2026-55569 aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

CVE-2026-55569

aqua (aquaproj/aqua), a declarative command-line version manager written in Go, contains a symlink traversal flaw in pkg/unarchive/archives.go (HandleFile). The handler calls os.Symlink with an unvalidated LinkTarget and does not jail the target to the extraction destination. A subsequent regular...

CVE-2026-55108

KubeVela 's Terraform remote configuration loader in pkg/controller/utils/capability.go (function GetTerraformConfigurationFromRemote) is vulnerable to denial of service. When a user with low privileges (ability to create or update ComponentDefinition objects) registers a Terraform remote schemat...

CVE-2026-82248

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...

CVE-2026-82252

gitoxide before 0.52.1 is vulnerable to a repository boundary violation via symlinked .gitmodules files. When reading the worktree .gitmodules file, gitoxide follows symlinks, allowing an attacker to create a malicious repository where .gitmodules points outside the repository tree. This causes g...

EUVD-2026-67704

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to pars...

CVE-2026-82248 gitoxide before 0.33.0 Path Traversal via symlink following

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...

CVE-2026-82248

gix-worktree-state before 0.33.0 (part of gitoxide ) is vulnerable to path traversal via symlink following on Windows. During non-exclusive (incremental) materialization with core.symlinks=true, if a symlink entry is first checked out at a path pointing outside the worktree, a subsequent checkout...

EUVD-2026-67700

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...