CVE-2026-64824-PoC

CVE-2026-64824 — Path traversal por enlace simbólico en la copia de seguridad y restauración de Home Assistant Core → RCE CVSS 8.4 Crítico · GHSA-cwh8-w64c-4j5h · CWE-22 / CWE-59 TL;DR Un atacante autenticado admin sube un tar de copia de seguridad manipulado. La ruta de restauración extrae el...

CVE-2025-4517-POC

CVE-2025-4517 利用 说明 本利用及描述由AI编写。如果发现任何错误或问题，请告知我！本利用已测试并确认有效。感谢！ 概述 本利用利用了 CVE-2025-4517 ，这是 Python tarfile 模块中的一个严重漏洞，通过组合符号链接路径遍历与硬链接操纵，可实现任意文件写入。该漏洞绕过了 Python 3.12 中引入的 filter="data" 保护机制。 漏洞详情 CVE ID : CVE-2025-4517 受影响版本 : Python 3.8.0 至 3.13.1 CVSS 评分 : 9.3（严重） 影响 : 以提升的权限进行任意文件写入 技术背景 该漏洞利...

CVE-2025-55188

CVE-2025-55188：7-Zip 任意文件写入 CVE-2025-55188 的概念验证，这是 7-Zip 中的一个任意文件写入漏洞。该漏洞已在 2025 年 8 月 3 日发布的 25.01 版本中修复。 注意：CVE-2025-55188 与 CVE-2025-11001 不同。 修复 CVE-2025-11001 的版本（25.00 版）仍然容易受到 通过符号链接攻击导致的任意代码执行的影响，原因是 CVE-2025-55188。 CVE-2025-55188 的发现和发布早于 CVE-2025-11001 的发布。 有关更详细的说明和漏洞分析，请参阅...

UBUNTU-CVE-2026-82455

RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be writt...

AWS-SAM-CLI-Vulnerabilities

Vulnerabilità di AWS SAM CLI CVE-2025-3047 e CVE-2025-3048 Questo README fornisce un'analisi dettagliata di due vulnerabilità di sicurezza riscontrate nell'AWS Serverless Application Model CLI AWS SAM CLI – CVE-2025-3047 e CVE-2025-3048 – insieme ai problemi a livello di codice e alle relative...

CVE-2026-62992

Smarty (PHP template engine) prior to 5.8.2 and 4.5.7 (4.x line) is affected by a symlink path-traversal in Security::_checkDir() that does not fully resolve symbolic links before validating the directory containment. An attacker who can place or reference a symlink inside a trusted Smarty direct...

OPENSUSE-SU-2026:21412-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues: - CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads and writes outside the configured data director bsc1271629. - CVE-2026-15043: DBI:SQL:Nano has incorrect predicate evaluation,...

CVE-2026-39822

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symbolic link pointing...

Important: python3.14

Issue Overview: tarfile.extractall with the 'data' or 'tar' filter could be bypassed by a crafted archive where a hardlink references a symlink stored at a deeper name than the hardlink itself. The extraction fallback validated the symlink at it's archived location but recreated it at the...

EUVD-2026-41624

Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths...

CVE-2026-53489

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue h...

CVE-2026-53489 containerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue h...

CVE-2026-53489

CVE-2026-53489 affects containerd CRI: when checkpoint restore occurs, the CRI plugin may read a host file by following a symlink for container.log. Vulnerable versions are prior to 2.3.2, 2.2.5 and 2.1.9. Impact described as arbitrary host file read via kubectl logs, with LOCAL attack potential ...

CVE-2026-53489

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an arbitrary file on the host via kubectl logs. This issue h...

PT-2026-53273

Name of the Vulnerable Software and Affected Versions acl versions prior to 2.4.0 Description A time-of-check to time-of-use TOCTOU race condition occurs when a local attacker replaces a pathname component with a symbolic link between an lstat check and subsequent symlink-following operations...

CVE-2026-54557 mise HTTP backend uses raw version path for install symlink destination

mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.6.1, the mise HTTP backend builds its install symlink destination from the raw resolved version string for non-latest versions. Normal tool install paths use the sanitized version pathname, but the HTTP backend's symlin...

GHSA-7Q4V-2MR6-5GPX Microsoft Security Advisory CVE-2026-45491 – .NET Tampering Vulnerability

Executive Summary Microsoft is releasing this security advisory to provide information about a vulnerability in System.Formats.Tar. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A tampering vulnerability exists in the...

CVE-2026-29203

CVE-2026-29203 affects the cPanel Nova plugin component Cpanel::Nova::Connector. A chmod call follows symlinks, enabling an authenticated cPanel user to set root permissions on arbitrary system files or directories by placing a symlink at a user-controlled legacy Nova path in their home directory...

Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision

Impact Weblate repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed when the external path shares the same string prefix as t...

CVE-2026-31802 node-tar Symlink Path Traversal via Drive-Relative Linkpath

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.11, tar npm can be tricked into creating a symlink that points outside the extraction directory by using a drive-relative symlink target such as C:../../../target.txt, which enables file overwrite outside cwd during normal tar.x...