subpath-exploit

Sample Kubernetes Escape via CVE-2017-1002101 Description After hearing about the issue and following this guide, I wanted to explore things a bit more. This repo contains a couple pod deployments and helper shell scripts that demonstrate the attack mechanism in the simplest way possible so that...

CVE-2026-14361

CVE-2026-14361 El helper writeToFile de Consul Template abría directamente un destino proporcionado por el operador y seguía los componentes de ruta con enlaces, lo que permitía que la salida renderizada escapara del directorio previsto y sobrescribiera un archivo preexistente. Introducción...

Security update for libvirt

This update for libvirt fixes the following issues: CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow bsc1275863. CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection bsc1274576. CVE-2026-63622...

Security update for libvirt

This update for libvirt fixes the following issues: CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow bsc1275863. CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection bsc1274576. CVE-2026-63622...

cve-2026-11837-ansible-posix-authorized-key

CVE-2026-11837: escalada de privilegios local en authorizedkey de ansible.posix Escalada de privilegios local en el módulo Ansible ansible.posix.authorizedkey mediante chown que sigue enlaces simbólicos y creación de archivos que sigue enlaces simbólicos en el directorio /.ssh del usuario y el...

CVE-2025-27591-Meta-below-LPE

CVE-2025-27591 — Meta below Symlink Local Privilege Escalation Overview Field| Details ---|--- CVE| CVE-2025-27591 Software| Meta below system resource monitor Affected Versions| 0.9.0 Vulnerability| Symlink following → arbitrary file overwrite as root Authentication| Local user with sudo access ...

CVE-2024-50404

CVE-2024-50404 https://www.qnap.com/en/security-advisory/qsa-24-48 https://www.cve.org/CVERecord?id=2024-50404 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N 6.8 "A link following vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow...

CVE-2026-53802

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

CVE-2026-85092

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

Fortinet_FortiClient_Exploit_CVE-2026-24018

Fortinet FortiClient Exploit CVE-2026-24018 Fully Working Exploit for CVE-2026-24018: A UNIX symbolic link Symlink following vulnerability in Fortinet FortiClientLinux 7.4.0 through 7.4.4, FortiClientLinux 7.2.2 through 7.2.12 leads to a local and unprivileged user to escalate their privileges to...

CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-85092 LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following

LiME through 1.12.0 fails to validate the disk acquisition output path and does not use ONOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the output directory can create a symbolic link...

CVE-2026-85092

LiME (Linux Memory Engine) through version 1.12.0 contains an arbitrary file overwrite vulnerability caused by a missing O_NOFOLLOW flag and insufficient validation of the operator-supplied disk acquisition output path. An unprivileged local attacker who controls the output directory can plant a ...

Dell PowerProtect Cyber Recovery < 20.3.0.0 Multiple Vulnerabilities (DSA-2026-370)

The version of Dell PowerProtect Cyber Recovery installed on the remote host is prior to 20.3.0.0. It is, therefore, affected by multiple vulnerabilities: - Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an SQL Command 'SQ...

GHSA-P498-V437-472G humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

Summary @humanfs/node does not treat symlinks as a separate case during copy operations. A symlink placed inside an attacker-controlled source tree can make copyAll read and copy the contents of any file readable by the process, even when that file is outside the directory being copied. Details T...

humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

Summary @humanfs/node does not treat symlinks as a separate case during copy operations. A symlink placed inside an attacker-controlled source tree can make copyAll read and copy the contents of any file readable by the process, even when that file is outside the directory being copied. Details T...

CVE-2026-D0cker

CVE-2026-Pending: Escape de contenedor a través de la vulnerabilidad maskPaths de runC Severidad: Crítica CVSS 9.8 Componente: opencontainers/runc libcontainer Tipo de vulnerabilidad: CWE-59: Resolución incorrecta de enlaces antes del acceso al archivo 'Link Following' 🚨 Resumen ejecutivo Existe...

MiracleLinux 8 : abrt-2.10.9-26.el8_10.ML.1 (AXSA:2026-1725:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1725:01 advisory. abrt: TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories CVE-2026-54228 abrt: ChownProblemDir succeeds...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

Linux Distros Unpatched Vulnerability : CVE-2026-82252

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata...