libvirt: swtpm privilege escalation via symlink following

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

subpath-exploit

サンプルKubernetesエスケープ（CVE-2017-1002101経由） 説明 本問題について耳にし、このガイドを参考にした後、もう少し詳しく調べてみたいと思いました。このリポジトリには、攻撃メカニズムを可能な限り単純な方法で示すいくつかのPodデプロイメントと補助シェルスクリプトが含まれており、Kubernetes管理者や運用者が深刻さと潜在的なリスクを完全に理解できるようにしています。認証済みユーザーであるか、Podのspec/template作成時に制御できる必要があるため、このエスケープが匿名で行われる可能性は低く、このような他の攻撃と組み合わせなければ実現しません。...

Important: Red Hat Security Advisory: virt:rhel security update

An update for the virt:rhel module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

libvirt: swtpm privilege escalation via symlink following

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

CVE-2026-14361

CVE-2026-14361 Consul Template の writeToFile ヘルパーは、オペレーターが指定した宛先を直接開き、リンクされたパスコンポーネントをたどるため、レンダリングされた出力が意図したディレクトリの外に逃れ、既存のファイルを上書きする可能性がありました。 はじめに この問題は、HashiCorp Consul Template をレビューしているときに、直接的なファイルシステムのセキュリティ問題を念頭に置いて見つけました。 writeToFile...

Fortinet_FortiClient_Exploit_CVE-2026-24018

Fortinet FortiClient 漏洞利用 CVE-2026-24018 针对 CVE-2026-24018 的完整可用漏洞利用：Fortinet FortiClientLinux 7.4.0 至 7.4.4、FortiClientLinux 7.2.2 至 7.2.12 中存在 UNIX 符号链接（Symlink）跟随漏洞，可导致本地非特权用户将其权限提升至 root。 https://github.com/user-attachments/assets/ba55bae6-acea-4391-a568-f5e44089a284...

gortex-PoC

索引器文件遍历中的符号链接跟随 → 通过 searchtext 泄露仓库外内容 CVE 状态： 已申请，待分配。此发现已发布为 GHSA-6vhf-4wcm-2r83。在 CVE 分配后，本仓库将重命名为 CVE-YYYY-NNNNN-gortex-PoC，且此横幅将替换为 CVE 链接。 | ---|--- 研究员| Dostxodjayev Abdullox @squeeze440 安全公告| GHSA-6vhf-4wcm-2r83 CVSS 3.1| 5.5 中危 弱点| CWE-59, CWE-200 索引器文件遍历中的符号链接跟随 → 通过 searchtext 泄露仓库外内容...

CVE-2026-D0cker

CVE-2026-Pending: runC maskPaths 脆弱性によるコンテナエスケープ 深刻度: クリティカル CVSS 9.8 コンポーネント: opencontainers/runc libcontainer 脆弱性タイプ: CWE-59: ファイルアクセス前のリンク解決の不備 'Link Following' 🚨 エグゼクティブサマリー runc の maskPaths 関数に重大な脆弱性が存在します。コンテナ内の機密パス 例: /proc/kcore をマスクする際、runc は os.OpenFilepath, OPATH, 0 を ONOFOLLOW...

MiracleLinux 8 : mrtg-2.17.7-1.el8_10.1 (AXSA:2026-1849:03)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1849:03 advisory. mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation CVE-2026-72694 Tenable has extracted the preceding...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

BIT-RCLONE-2026-88016 rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path...

rsync: rsync: Arbitrary File Read via Symlink Following

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

rsync: rsync: Local Privilege Escalation via Symlink Following

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...

rsync: rsync: Local Privilege Escalation via Symlink Following

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...

rsync: rsync: Arbitrary File Read via Symlink Following

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

OESA-2026-3832 libvirt security update

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes. The main package includes the libvirtd server exporting the virtualization support. Security Fixes: A flaw was found in libvirt. An unprivileged local user could exploit an integer...

Security update for libvirt

This update for libvirt fixes the following issues: CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow bsc1275863. CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection bsc1274576. CVE-2026-63622...

cve-2026-11837-ansible-posix-authorized-key

CVE-2026-11837: ansible.posix authorizedkey 本地权限提升 通过跟随符号链接的 chown（以及跟随符号链接的文件创建）对用户的 /.ssh 目录和 authorizedkeys 文件，在 ansible.posix.authorizedkey Ansible 模块中实现本地权限提升。 这是一份关于我报告的漏洞的书面说明，该漏洞已被红帽产品安全团队（CNA）分配为 CVE-2026-11837 。此处作为技术记录发布，而非声称具有新颖性：该问题是 CVE-2024-9902 的 同源问题 ，早期修复未覆盖到该模块。 官方参考 红帽 CVE...

ALSA-2026:67463 Important: rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fixes:...