trellix-tarslip-patch-bypass

trellix-tarslip-patch-bypass 2023年，Trellix宣布1，他们为超过61,000个开源项目修补了CVE-2007-4559，这是一个旧路径遍历漏洞。分析他们的修补程序，很容易注意到可以使用符号链接绕过。 符号链接路径遍历是一种旧技术，在LiveOverflow的视频严重 .zip 漏洞？ - Zip Slip 和 ZipperDown中也展示过。 1 Trellix Advanced Research Center 修补了61,000个易受攻击的开源项目 PoC docker build -t tarslip . docker run -it tarsl...

AWS-SAM-CLI-Vulnerabilities

AWS SAM CLI 漏洞（CVE-2025-3047 和 CVE-2025-3048） 本自述文件详细分析了 AWS Serverless Application Model CLI（AWS SAM CLI）中发现的两个安全漏洞——CVE-2025-3047 和 CVE-2025-3048，以及相关的代码级问题和修复。这两个漏洞都涉及在使用 Docker 容器进行构建过程中对符号链接的不正确处理。以下每一节涵盖一个 CVE，包括摘要、受影响代码（引用 SAM CLI 源代码）、补丁及其解决问题的方式，以及补救指南。 这些缺陷涉及 sam build --use-container...

rcetest

CVE-2024-32002: git clone を介した Git RCE の悪用 このリポジトリには、git clone 操作中に RCE を許可する Git の脆弱性 CVE-2024-32002 を悪用するための PoC が含まれています。特定の方法でサブモジュールを持つリポジトリを作成することにより、攻撃者は大文字と小文字を区別しないファイルシステム上のシンボリックリンク処理を悪用して .git/ ディレクトリにファイルを書き込み、悪意のあるフックの実行につなげることができます。 注: この PoC は Windows または Mac システムでのみ動作します。 ブログ記事...

RLSA-2026:74424 Important: libvirt security, bug fix, and enhancement update

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems. Security Fixes: libvirt: swtpm privilege escalation via symlink following...

Gogs <= 0.13.3 - Remote Code Execution

Gogs self-hosted Git service versions 0.13.3 and earlier contain a critical symlink bypass vulnerability that circumvents the fix for CVE-2024-55947. Authenticated users can exploit improper symbolic link handling in the PutContents API to overwrite files outside the repository by committing a...

Fedora 43 : buildstream (2026-e14ea5695c)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-e14ea5695c advisory. CVE-2026-82331 CWE-59: tar source plugin symlink escape while fetching a malicious tarball Python = 3.12, so the packaged /usr/bin/bst was already using...

Fedora 44 : buildstream (2026-ccf62cb9b3)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-ccf62cb9b3 advisory. CVE-2026-82331 CWE-59: tar source plugin symlink escape while fetching a malicious tarball Python = 3.12, so the packaged /usr/bin/bst was already using...

Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.6.2. Vulnerability Details CVEID:CVE-2020-5258 DESCRIPTION: In affected versions of dojo NPM package, the deepCopy method is vulnerable to Prototype Pollution. Prototype Pollution refers to the ability to inject...

EUVD-2026-80863

Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path...

Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections

Summary Dulwich's porcelain.checkoutpaths=... code path writes files using raw os.openfilepath, OWRONLY|OCREAT|OTRUNC, mode followed by f.writeobj.data. This code path does NOT call buildfilefromblob at all, completely bypassing any symlink protections including the unreleased d09f8af fix. os.ope...

GHSA-8W8G-WQ8H-FQ33 Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections

Summary Dulwich's porcelain.checkoutpaths=... code path writes files using raw os.openfilepath, OWRONLY|OCREAT|OTRUNC, mode followed by f.writeobj.data. This code path does NOT call buildfilefromblob at all, completely bypassing any symlink protections including the unreleased d09f8af fix. os.ope...

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following via the paths= branch of porcelain.checkout in dulwich, which wrote file content using a raw os.openfilepath, OWRONLY|OCREAT|OTRUNC call that follows existing symlinks at the target path. An attacker...

GHSA-5FQC-MRG8-W798 Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence

Summary Dulwich's filterbranch.py CommitFilter.applyindexfilter is vulnerable to symlink directory traversal. When processing commit history, materialized tree entries including symlinks persist in the working directory between commits, allowing a symlink from an ancestor commit to redirect file...

Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence

Summary Dulwich's filterbranch.py CommitFilter.applyindexfilter is vulnerable to symlink directory traversal. When processing commit history, materialized tree entries including symlinks persist in the working directory between commits, allowing a symlink from an ancestor commit to redirect file...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via applyindexfilter in dulwich/filterbranch.py, which called buildindexfromtree".", ... to materialize tree entries into the caller's working directory and left them there between commits. An attacker can craft a...

Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks

Summary Dulwich's stash.py:pop function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository. Root Cause The pop function at dulwich/stash.py:236 uses os.path.existsparentdi...

GHSA-CM62-GVXX-VMXX Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks

Summary Dulwich's stash.py:pop function is vulnerable to symlink directory traversal, allowing an attacker to write arbitrary files outside the repository worktree when a victim pops a stash in a malicious repository. Root Cause The pop function at dulwich/stash.py:236 uses os.path.existsparentdi...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via verifyleadingdirs absent in affected versions in dulwich/stash.py during stash.pop. The old path-existence check used os.path.exists, which follows symlinks, so a stash entry whose parent path component is a symlink...

SUSE-SU-2026:4417-1 Security update for helm

This update for helm fixes the following issues: - CVE-2026-85731: oras.land/oras-go/v2: arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction bsc1281104. - CVE-2026-85732: oras.land/oras-go/v2: blind SSRF via unvalidated Link header URL in pagination allows...

libvirt: swtpm privilege escalation via symlink following

A flaw was found in libvirt. A local attacker, specifically a process running as the confined swtpm user, could exploit a symlink-following vulnerability in the virFileChownFiles function. By planting a symbolic link within the swtpm state directory, the attacker could trick the root-level libvir...