subpath-exploit

Ejemplo de Escape de Kubernetes mediante CVE-2017-1002101 Descripción Después de conocer el problema y seguir esta guía, quise explorar un poco más. Este repositorio contiene un par de despliegues de pods y scripts auxiliares de shell que demuestran el mecanismo de ataque de la manera más simple...

CVE-2026-14361

CVE-2026-14361 Consul Template's writeToFile helper opened an operator-supplied destination directly and followed linked path components, allowing rendered output to escape the intended directory and overwrite a preexisting file. Intro I found this issue while reviewing HashiCorp Consul Template ...

libvirt: swtpm privilege escalation via symlink following

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

Important: Red Hat Security Advisory: virt:rhel security update

An update for the virt:rhel module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

libvirt: swtpm privilege escalation via symlink following

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...

Fortinet_FortiClient_Exploit_CVE-2026-24018

Fortinet FortiClient Exploit CVE-2026-24018 Fully Working Exploit for CVE-2026-24018: A UNIX symbolic link Symlink following vulnerability in Fortinet FortiClientLinux 7.4.0 through 7.4.4, FortiClientLinux 7.2.2 through 7.2.12 leads to a local and unprivileged user to escalate their privileges to...

gortex-PoC

Symlink Following in Indexer File-Walk → Out-of-Repo Content Disclosure via searchtext CVE status: requested, pending assignment. This finding is published as GHSA-6vhf-4wcm-2r83. On CVE assignment this repository is renamed CVE-YYYY-NNNNN-gortex-PoC and this banner is replaced with the CVE link...

CVE-2026-D0cker

CVE-2026-Pending: Container Escape via runC maskPaths Vunlerability Severity: Critical CVSS 9.8 Component: opencontainers/runc libcontainer Vulnerability Type: CWE-59: Improper Link Resolution Before File Access 'Link Following' 🚨 Executive Summary A critical vulnerability exists in runc's...

MiracleLinux 8 : mrtg-2.17.7-1.el8_10.1 (AXSA:2026-1849:03)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1849:03 advisory. mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation CVE-2026-72694 Tenable has extracted the preceding...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

golang: Go os.Root: Symlink following vulnerability allows directory traversal

A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...

BIT-RCLONE-2026-88016 rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path...

rsync: rsync: Arbitrary File Read via Symlink Following

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

rsync: rsync: Local Privilege Escalation via Symlink Following

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...

rsync: rsync: Local Privilege Escalation via Symlink Following

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...

rsync: rsync: Arbitrary File Read via Symlink Following

A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...

OESA-2026-3832 libvirt security update

Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes. The main package includes the libvirtd server exporting the virtualization support. Security Fixes: A flaw was found in libvirt. An unprivileged local user could exploit an integer...

Security update for libvirt

This update for libvirt fixes the following issues: CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow bsc1275863. CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection bsc1274576. CVE-2026-63622...

cve-2026-11837-ansible-posix-authorized-key

CVE-2026-11837: escalada de privilegios local en authorizedkey de ansible.posix Escalada de privilegios local en el módulo Ansible ansible.posix.authorizedkey mediante chown que sigue enlaces simbólicos y creación de archivos que sigue enlaces simbólicos en el directorio /.ssh del usuario y el...

ALSA-2026:67463 Important: rsync security, bug fix, and enhancement update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fixes:...