CVE-2026-14361

CVE-2026-14361 El helper writeToFile de Consul Template abría directamente un destino proporcionado por el operador y seguía los componentes de ruta con enlaces, lo que permitía que la salida renderizada escapara del directorio previsto y sobrescribiera un archivo preexistente. Introducción...

subpath-exploit

通过 CVE-2017-1002101 实现 Kubernetes 逃逸示例 描述 在了解到这个问题并参考此指南后，我想进一步探索。该仓库包含几个 Pod 部署和辅助 Shell 脚本，以最简单的方式演示了攻击机制，使 Kubernetes 管理员和运维人员能够充分理解其严重性和潜在风险。您必须是已认证用户，或者能够在创建 Pod 时控制其 spec/template，因此这种逃逸不太可能以匿名方式发生，除非与其他攻击（如这个）结合使用。 快速解释 当 Kubelet 挂载卷/密钥/配置映射等时，它会错误地跟随卷内部的符号链接，访问到本应限制范围之外的位置。由于 Kubelet 以 ro...

CVE-2026-77159

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

EUVD-2026-76070

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mount...

CVE-2026-77159 Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

EUVD-2026-76034

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

CVE-2026-77159

A symlink-following flaw in libvirt's qemuTPMEmulatorPrepareHost() function performs a path-based chown() on the swtpm log file without validating for symbolic links. A local attacker with access to the swtpm account can replace the log file with a symlink, causing the root-level libvirtd daemon ...

CVE-2026-77159

A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost function. The function uses a path-based chown on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd running as...

CVE-2026-68488

A Time-of-check Time-of-use TOCTOU race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover...

EUVD-2026-75594

A Time-of-check Time-of-use TOCTOU race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover...

CVE-2026-68488

A Time-of-check Time-of-use TOCTOU race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover...

CVE-2026-68488

CVE-2026-68488 is a TOCTOU race condition in Plesk's Backup Manager that leads to insecure symlink following during restore operations. An attacker with low privileges can exploit this to take over ownership of arbitrary files or directories, resulting in local privilege escalation to root . The ...

gortex-PoC

Seguimiento de enlaces simbólicos en el recorrido de archivos del indexador → Divulgación de contenido fuera del repositorio mediante searchtext Estado del CVE: solicitado, asignación pendiente. Este hallazgo se publica como GHSA-6vhf-4wcm-2r83. Tras la asignación del CVE, este repositorio se...

CVE-2026-88265

A flaw was found in crun. After pivotroot, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed relea...

CVE-2026-88265

A flaw was found in crun. After pivotroot, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed relea...

Fortinet_FortiClient_Exploit_CVE-2026-24018

Exploit de Fortinet FortiClient CVE-2026-24018 Exploit totalmente funcional para CVE-2026-24018: una vulnerabilidad de seguimiento de enlaces simbólicos Symlink de UNIX en Fortinet FortiClientLinux 7.4.0 hasta 7.4.4, FortiClientLinux 7.2.2 hasta 7.2.12 permite a un usuario local y sin privilegios...

Amazon Linux 2 : containerd (ALASNITRO-ENCLAVES-2026-118)

The version of containerd installed on the remote host is prior to 2.2.7-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-118 advisory. Fix GHSA-p7v4-vr35-mj6f; containerd CRI plugin: Checkpoint restore bypasses destination security context.A...

Oracle Linux 8 : ELSA-2026-65832-0: / mrtg (ELSA-2026-658320)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-658320 advisory. 2.17.7-1.1 - Fix CVE-2026-72694: symlink-following chown in PID file handling Resolves: RHEL-236037 Tenable has extracted the preceding description block...

CVE-2026-D0cker

CVE-2026-Pending: Escape de contenedor a través de la vulnerabilidad maskPaths de runC Severidad: Crítica CVSS 9.8 Componente: opencontainers/runc libcontainer Tipo de vulnerabilidad: CWE-59: Resolución incorrecta de enlaces antes del acceso al archivo 'Link Following' 🚨 Resumen ejecutivo Existe...

RLSA-2026:65832 Important: mrtg security update

The Multi Router Traffic Grapher MRTG monitors the traffic load on network connections. MRTG generates HTML pages containing PNG images which provide a live visual representation of this traffic. Security Fixes: mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID...