CVE-2026-14361

CVE-2026-14361 Consul Template의 writeToFile 헬퍼는 운영자가 지정한 대상을 직접 열고 연결된 경로 구성 요소를 따르므로, 렌더링된 출력이 의도된 디렉터리를 벗어나 기존 파일을 덮어쓸 수 있습니다. 소개 저는 HashiCorp Consul Template 을 검토하면서 다음과 같은 직접적인 파일시스템 보안 질문을 염두에 두고 이 문제를 발견했습니다: writeToFile이 의도된 디렉터리 안에 있는 것처럼 보이는 경로를 받으면, 파일시스템이 실제로 데이터를 기록할 위치를 검증합니까? 이 경우, ...

subpath-exploit

샘플 Kubernetes 탈출 - CVE-2017-1002101 이용 설명 이 문제에 대해 듣고 이 가이드를 따라가면서, 좀 더 탐구해보고 싶었습니다. 이 리포지토리는 몇 가지 파드 배포와 헬퍼 셸 스크립트를 포함하여, 쿠버네티스 관리자와 운영자가 심각성과 잠재적 위험을 완전히 이해할 수 있도록 공격 메커니즘을 가장 간단한 방식으로 보여줍니다. 인증된 사용자이거나 파드의 스펙/템플릿을 생성 시 제어할 수 있어야 하므로, 이 탈출은 다른 공격예: 이것과 결합하지 않으면 익명으로 이루어지지 않을 가능성이 높습니다. 빠른 설명...

libvirt: swtpm privilege escalation via symlink following

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

Important: Red Hat Security Advisory: virt:rhel security update

An update for the virt:rhel module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

libvirt: swtpm privilege escalation via symlink following

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

Fortinet_FortiClient_Exploit_CVE-2026-24018

Fortinet FortiClient エクスプロイト CVE-2026-24018 CVE-2026-24018 の完全動作エクスプロイト: Fortinet FortiClientLinux 7.4.0 から 7.4.4、FortiClientLinux 7.2.2 から 7.2.12 における UNIX シンボリックリンク（Symlink）追従の脆弱性により、ローカルの非特権ユーザーが権限を root に昇格させることができます。...

gortex-PoC

インデクサーのファイル走査におけるシンボリックリンク追跡 → searchtext によるリポジトリ外コンテンツの開示 CVE ステータス: 申請済み、割り当て待ち。この脆弱性は GHSA-6vhf-4wcm-2r83 として公開されています。CVE が割り当てられると、このリポジトリは CVE-YYYY-NNNNN-gortex-PoC に改名され、このバナーは CVE リンクに置き換えられます。...

CVE-2026-D0cker

CVE-2026-Pending: runC maskPaths 취약점을 통한 컨테이너 탈출 심각도: 치명적 CVSS 9.8 구성 요소: opencontainers/runc libcontainer 취약점 유형: CWE-59: 파일 접근 전 부적절한 링크 확인'Link Following' 🚨 핵심 요약 runc의 maskPaths 함수에 치명적인 취약점이 존재합니다. 컨테이너 내부에서 민감한 경로예: /proc/kcore를 마스킹할 때, runc는 ONOFOLLOW 플래그 없이 os.OpenFilepath, OPATH, 0을 사용합니...

MiracleLinux 8 : mrtg-2.17.7-1.el8_10.1 (AXSA:2026-1849:03)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1849:03 advisory. mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation CVE-2026-72694 Tenable has extracted the preceding...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

BIT-RCLONE-2026-88016 rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path...

rsync: rsync: Arbitrary File Read via Symlink Following

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

rsync: rsync: Local Privilege Escalation via Symlink Following

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...

rsync: rsync: Local Privilege Escalation via Symlink Following

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...

rsync: rsync: Arbitrary File Read via Symlink Following

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

OESA-2026-3832 libvirt security update

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes. The main package includes the libvirtd server exporting the virtualization support. Security Fixes: A flaw was found in libvirt. An unprivileged local user could exploit an integer...

Security update for libvirt

This update for libvirt fixes the following issues: CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow bsc1275863. CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection bsc1274576. CVE-2026-63622...

cve-2026-11837-ansible-posix-authorized-key

CVE-2026-11837: ansible.posix authorizedkey 로컬 권한 상승 사용자의 /.ssh 디렉터리 및 authorizedkeys 파일에 대한 심볼릭 링크를 따라가는 chown및 심볼릭 링크를 따라가는 파일 생성을 통한 ansible.posix.authorizedkey Ansible 모듈의 로컬 권한 상승입니다. 이는 제가 보고하고 Red Hat Product SecurityCNA에서 CVE-2026-11837 을 할당한 취약점에 대한 분석입니다. 기술 기록으로서 여기에 게시되며, 새로운 발견을 주장하는...

ALSA-2026:67463 Important: rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fixes:...