CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME (Linux Memory Engine) through version 1.12.0 contains an arbitrary file overwrite vulnerability caused by a missing O_NOFOLLOW flag and insufficient validation of the operator-supplied disk acquisition output path. An unprivileged local attacker who controls the output directory can plant a ...

CVE-2026-14361

CVE-2026-14361 Помощник writeToFile в Consul Template открывал указанное оператором место назначения напрямую и следовал по связанным компонентам пути, позволяя отрисованному выводу выйти за пределы задуманного каталога и перезаписать существующий файл. Intro Я нашёл эту проблему при анализе...

humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

Summary @humanfs/node does not treat symlinks as a separate case during copy operations. A symlink placed inside an attacker-controlled source tree can make copyAll read and copy the contents of any file readable by the process, even when that file is outside the directory being copied. Details T...

subpath-exploit

Пример ухода из Kubernetes через CVE-2017-1002101 Описание Узнав о проблеме и следуя этому руководству, я захотел изучить её подробнее. Этот репозиторий содержит несколько развёртываний подов и вспомогательные shell-скрипты, которые демонстрируют механизм атаки самым простым способом, чтобы...

CVE-2026-D0cker

CVE-2026-Pending: Побег из контейнера через уязвимость runC maskPaths Серьёзность: Критическая CVSS 9.8 Компонент: opencontainers/runc libcontainer Тип уязвимости: CWE-59: Неправильное разрешение ссылок перед доступом к файлу 'Link Following' 🚨 Краткое описание Критическая уязвимость существует в...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

CVE-2024-50404

CVE-2024-50404 https://www.qnap.com/en/security-advisory/qsa-24-48 https://www.cve.org/CVERecord?id=2024-50404 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N 6.8 "Une vulnérabilité de type lien symbolique a été signalée affectant Qsync Central. Si elle est exploitée, la...

cve-2026-11837-ansible-posix-authorized-key

CVE-2026-11837: escalatione dei privilegi locali in ansible.posix.authorizedkey Escalatione locale dei privilegi nel modulo Ansible ansible.posix.authorizedkey tramite chown che segue i collegamenti simbolici e creazione di file che segue i collegamenti sulla directory /.ssh e sul file...

CVE-2025-27591-Meta-below-LPE

CVE-2025-27591 — Meta below: escalation locale dei privilegi tramite symlink Panoramica Campo| Dettagli ---|--- CVE| CVE-2025-27591 Software| Meta below monitor delle risorse di sistema Versioni interessate| 0.9.0 Vulnerabilità| Follow di symlink → sovrascrittura arbitraria di file come root...

CVE-2026-55569

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

CVE-2026-55569 aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

CVE-2026-55569

aqua (aquaproj/aqua), a declarative command-line version manager written in Go, contains a symlink traversal flaw in pkg/unarchive/archives.go (HandleFile). The handler calls os.Symlink with an unvalidated LinkTarget and does not jail the target to the extraction destination. A subsequent regular...

CVE-2026-55569 aqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

CVE-2026-55108

KubeVela 's Terraform remote configuration loader in pkg/controller/utils/capability.go (function GetTerraformConfigurationFromRemote) is vulnerable to denial of service. When a user with low privileges (ability to create or update ComponentDefinition objects) registers a Terraform remote schemat...

CVE-2026-82248

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...

UBUNTU-CVE-2026-82252

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to pars...

CVE-2026-82248

gix-worktree-state before 0.33.0 part of gitoxide allows writing files outside the worktree on Windows. gixworktreestate::checkout follows an existing terminal symlink during non-exclusive incremental materialization destinationisinitiallyempty: false when core.symlinks is true. If a symlink entr...

CVE-2026-82252

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to pars...

CVE-2026-82252

gitoxide before 0.52.1 is vulnerable to a repository boundary violation via symlinked .gitmodules files. When reading the worktree .gitmodules file, gitoxide follows symlinks, allowing an attacker to create a malicious repository where .gitmodules points outside the repository tree. This causes g...

EUVD-2026-67704

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repository tree, causing gitoxide to pars...