604 matches found
subpath-exploit
Ejemplo de Escape de Kubernetes mediante CVE-2017-1002101 Descripción Después de conocer el problema y seguir esta guía, quise explorar un poco más. Este repositorio contiene un par de despliegues de pods y scripts auxiliares de shell que demuestran el mecanismo de ataque de la manera más simple...
CVE-2026-14361
CVE-2026-14361 Consul Template 的 writeToFile 辅助函数直接打开操作者提供的目标路径,并跟随被链接的路径组件,从而使渲染输出能够逃逸预期目录并覆盖已存在的文件。 简介 我在审查 HashiCorp Consul Template 时发现了这个问题,当时脑海中有一个直接的文件系统安全问题: 如果writeToFile 收到的路径看似位于预期目录之内,它是否会验证文件系统实际将数据写入何处? 在本例中,答案是否定的。 writeToFile 模板辅助函数通过 os.Create 或 os.OpenFile 直接打开用户提供的最终路径。...
libvirt: swtpm privilege escalation via symlink following
A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...
Important: Red Hat Security Advisory: virt:rhel security update
An update for the virt:rhel module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
libvirt: swtpm privilege escalation via symlink following
A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...
Fortinet_FortiClient_Exploit_CVE-2026-24018
Fortinet FortiClient 漏洞利用 CVE-2026-24018 针对 CVE-2026-24018 的完整可用漏洞利用:Fortinet FortiClientLinux 7.4.0 至 7.4.4、FortiClientLinux 7.2.2 至 7.2.12 中存在 UNIX 符号链接(Symlink)跟随漏洞,可导致本地非特权用户将其权限提升至 root。 https://github.com/user-attachments/assets/ba55bae6-acea-4391-a568-f5e44089a284...
gortex-PoC
Seguimiento de enlaces simbólicos en el recorrido de archivos del indexador → Divulgación de contenido fuera del repositorio mediante searchtext Estado del CVE: solicitado, asignación pendiente. Este hallazgo se publica como GHSA-6vhf-4wcm-2r83. Tras la asignación del CVE, este repositorio se...
CVE-2026-D0cker
CVE-2026-Pending: 通过 runC maskPaths 漏洞实现容器逃逸 严重级别: 严重 CVSS 9.8 组件: opencontainers/runc libcontainer 漏洞类型: CWE-59: 在访问文件前未正确解析链接('链接跟随') 🚨 执行摘要 runc 的 maskPaths 函数存在一个严重漏洞。当在容器内屏蔽敏感路径(如 /proc/kcore)时,runc 使用了 os.OpenFilepath, OPATH, 0 但没有添加 ONOFOLLOW 标志。这允许恶意容器进程将目标路径替换为指向敏感主机文件(例如...
MiracleLinux 8 : mrtg-2.17.7-1.el8_10.1 (AXSA:2026-1849:03)
The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1849:03 advisory. mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation CVE-2026-72694 Tenable has extracted the preceding...
golang: Go os.Root: Symlink following vulnerability allows directory traversal
A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...
golang: Go os.Root: Symlink following vulnerability allows directory traversal
A flaw was found in the os.Root functionality of Go on Unix systems. This vulnerability allows an attacker to bypass intended directory restrictions by crafting a path that ends with a symbolic link and a trailing slash. When a file is opened in os.Root with such a path, the symbolic link is...
BIT-RCLONE-2026-88016 rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path...
rsync: rsync: Arbitrary File Read via Symlink Following
A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...
rsync: rsync: Local Privilege Escalation via Symlink Following
A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...
rsync: rsync: Local Privilege Escalation via Symlink Following
A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...
rsync: rsync: Arbitrary File Read via Symlink Following
A flaw was found in rsync. A local attacker with low privileges can exploit a symlink following vulnerability in the handling of input configuration files, such as those specified by --files-from or --password-file. This allows the attacker to read arbitrary files accessible to the rsync daemon...
OESA-2026-3832 libvirt security update
Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes. The main package includes the libvirtd server exporting the virtualization support. Security Fixes: A flaw was found in libvirt. An unprivileged local user could exploit an integer...
Security update for libvirt
This update for libvirt fixes the following issues: CVE-2026-18917: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow bsc1275863. CVE-2026-61477: newline injection in network XML DNS TXT/SRV fields allows dnsmasq config directive injection bsc1274576. CVE-2026-63622...
cve-2026-11837-ansible-posix-authorized-key
CVE-2026-11837: ansible.posix authorizedkey 本地权限提升 通过跟随符号链接的 chown(以及跟随符号链接的文件创建)对用户的 /.ssh 目录和 authorizedkeys 文件,在 ansible.posix.authorizedkey Ansible 模块中实现本地权限提升。 这是一份关于我报告的漏洞的书面说明,该漏洞已被红帽产品安全团队(CNA)分配为 CVE-2026-11837 。此处作为技术记录发布,而非声称具有新颖性:该问题是 CVE-2024-9902 的 同源问题 ,早期修复未覆盖到该模块。 官方参考 红帽 CVE...
ALSA-2026:67463 Important: rsync security, bug fix, and enhancement update
The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used as a mirroring tool. Security Fixes:...