568 matches found
subpath-exploit
Ejemplo de Escape de Kubernetes mediante CVE-2017-1002101 Descripción Después de conocer el problema y seguir esta guía, quise explorar un poco más. Este repositorio contiene un par de despliegues de pods y scripts auxiliares de shell que demuestran el mecanismo de ataque de la manera más simple...
CVE-2026-14361
CVE-2026-14361 Consul Template's writeToFile helper opened an operator-supplied destination directly and followed linked path components, allowing rendered output to escape the intended directory and overwrite a preexisting file. Intro I found this issue while reviewing HashiCorp Consul Template ...
rsync: rsync: Arbitrary File Read via Symlink Following
A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...
rsync: rsync: Local Privilege Escalation via Symlink Following
A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...
rsync: rsync: Arbitrary File Read via Symlink Following
A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...
rsync: rsync: Local Privilege Escalation via Symlink Following
A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...
cve-2026-11837-ansible-posix-authorized-key
CVE-2026-11837: escalada de privilegios local en authorizedkey de ansible.posix Escalada de privilegios local en el módulo Ansible ansible.posix.authorizedkey mediante chown que sigue enlaces simbólicos y creación de archivos que sigue enlaces simbólicos en el directorio /.ssh del usuario y el...
CVE-2025-27591-Meta-below-LPE
CVE-2025-27591 — Escalada de privilegios local por symlink en Meta below Descripción general Campo| Detalles ---|--- CVE| CVE-2025-27591 Software| Meta below monitor de recursos del sistema Versiones afectadas| 0.9.0 Vulnerabilidad| Seguimiento de symlink → sobrescritura arbitraria de archivos co...
CVE-2024-50404
CVE-2024-50404 https://www.qnap.com/en/security-advisory/qsa-24-48 https://www.cve.org/CVERecord?id=2024-50404 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N 6.8 "A link following vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow...
CVE-2026-77159
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...
EUVD-2026-76070
Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...
CVE-2026-77159 Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...
EUVD-2026-76034
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...
CVE-2026-77159
A symlink-following flaw in libvirt's qemuTPMEmulatorPrepareHost() function performs a path-based chown() on the swtpm log file without validating for symbolic links. A local attacker with access to the swtpm account can replace the log file with a symlink, causing the root-level libvirtd daemon ...
CVE-2026-77159
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...
Linux Distros Unpatched Vulnerability : CVE-2026-88016
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with...
Linux Distros Unpatched Vulnerability : CVE-2026-77159
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking...
GHSA-F8G7-2XJC-7MFH rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
Summary With -l/--links, rclone's local backend recreates a source .rclonelink object as a real symlink at the destination verbatim preserved by design for faithful backups. Directory-metadata application, however, does not go through the os.Root sandbox and does not use NOFOLLOW syscalls. A loca...