subpath-exploit

Пример ухода из Kubernetes через CVE-2017-1002101 Описание Узнав о проблеме и следуя этому руководству, я захотел изучить её подробнее. Этот репозиторий содержит несколько развёртываний подов и вспомогательные shell-скрипты, которые демонстрируют механизм атаки самым простым способом, чтобы...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

CVE-2026-75038

UNIX symbolic link symlink following vulnerability in ilya-zlobintsev/LACT allows for local denial-of-service. This issue affects LACT: through 0.10.0...

CVE-2026-D0cker

CVE-2026-Pending: Побег из контейнера через уязвимость runC maskPaths Серьёзность: Критическая CVSS 9.8 Компонент: opencontainers/runc libcontainer Тип уязвимости: CWE-59: Неправильное разрешение ссылок перед доступом к файлу 'Link Following' 🚨 Краткое описание Критическая уязвимость существует в...

EUVD-2026-65393

UNIX symbolic link symlink following vulnerability in ilya-zlobintsev/LACT allows for local denial-of-service. This issue affects LACT: through 0.10.0...

CVE-2024-50404

CVE-2024-50404 https://www.qnap.com/en/security-advisory/qsa-24-48 https://www.cve.org/CVERecord?id=2024-50404 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N 6.8 "링크 추적link following 취약점이 Qsync Central에 영향을 미치는 것으로 보고되었습니다. 악용될 경우, 이 취약점으로 인해 사용자 접근 권한을 획득한 원격 공격자가 파일 시스템을 탐색하여...

CVE-2026-72696

Grav CMS versions before 2.0.16 are affected by a symlink following vulnerability in the Scheduler Job::createLockFile() method. The root cause is that lock file paths are predictable and reside in a world-writable temp directory , allowing a local attacker to pre-create a symlink at the expected...

EUVD-2026-65210

Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attackers can place a symlink at the predictabl...

CVE-2026-76845

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with...

CVE-2026-76845 adm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction

adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with...

CVE-2026-14361

CVE-2026-14361 Помощник writeToFile в Consul Template открывал указанное оператором место назначения напрямую и следовал по связанным компонентам пути, позволяя отрисованному выводу выйти за пределы задуманного каталога и перезаписать существующий файл. Intro Я нашёл эту проблему при анализе...

PT-2026-79855

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the...

cve-2026-11837-ansible-posix-authorized-key

CVE-2026-11837: ansible.posix authorizedkey 로컬 권한 상승 사용자의 /.ssh 디렉터리 및 authorizedkeys 파일에 대한 심볼릭 링크를 따라가는 chown및 심볼릭 링크를 따라가는 파일 생성을 통한 ansible.posix.authorizedkey Ansible 모듈의 로컬 권한 상승입니다. 이는 제가 보고하고 Red Hat Product SecurityCNA에서 CVE-2026-11837 을 할당한 취약점에 대한 분석입니다. 기술 기록으로서 여기에 게시되며, 새로운 발견을 주장하는...

CVE-2025-27591-Meta-below-LPE

CVE-2025-27591 — Meta below — повышение локальных привилегий через симлинк Обзор Поле| Подробности ---|--- CVE| CVE-2025-27591 Программное обеспечение| Meta below монитор системных ресурсов Затронутые версии| 0.9.0 Уязвимость| Следование за симлинком → произвольная перезапись файла от root...

CVE-2026-55168

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an...

CVE-2026-44517

Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left ...

EUVD-2026-64143

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an...

CVE-2026-44517

Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left ...

CVE-2026-44517 Buildah: Build breakout using malicious Containerfile and Git Smart HTTP server or GitHub release tar archive

Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left ...

CVE-2026-49114

In ONNX before 1.21.0, the 'saveexternaldata' function builds the external-data file path from the model's externaldata location field and opens it for writing without 'ONOFOLLOW/OEXCL', after a non-atomic 'os.path.isfile' check. A local attacker with write access to the directory where a victim...