CVE-2026-108119

A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive...

CVE-2026-64824-PoC

CVE-2026-64824 — Home Assistant Core Backup-Restore Symlink Path Traversal → RCE CVSS 8.4 Critical · GHSA-cwh8-w64c-4j5h · CWE-22 / CWE-59 TL;DR Authenticated admin attacker uploads a crafted backup tar. The restore path extracts the inner homeassistant.tar.gz with filter="fullytrusted" and only...

CVE-2026-107810

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restorenginx and restorenginxui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create an...

Security update for flatpak

This update for flatpak fixes the following issues: CVE-2026-90616: missing symlink protection allows a malicious sandboxed app to obtain arbitrary read and write access to files on the host bsc1280236. CVE-2026-92162: path traversal via unvalidated arch parameter in DeployAppstream bsc1282514...

CVE-2026-107810

The Nginx UI web interface (versions 2.0.0 through 2.5.0 ) is vulnerable to a symlink traversal issue in internal/backup/restore.go. The application extracts archives and follows crafted symlinks targeting the live Nginx configuration path before applying necessary restore flags. An authenticated...

EUVD-2026-95894

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restorenginx and restorenginxui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create an...

CVE-2025-68937

CVE-2025-68937 - Gitea/Forgejo Template Symlink RCE Automated proof-of-concept for CVE-2025-68937 : directory traversal via symlink dereferencing in Gitea and Forgejo template repository processing, leading to remote code execution. Any authenticated user no admin required can obtain a shell as t...

CVE-2025-48384-poc

CVE-2025-48384-poc CVE-2025-48384 se presenta como una vulnerabilidad de resolución de enlace incorrecta seguimiento de enlaces en git. Específicamente, los nombres de archivo con retornos de carro se analizan incorrectamente en .git/config, e incluir un enlace simbólico para apuntar a un...

CVE-2025-8110

CVE-2025-8110 – Gogs ≤ 0.13.3 RCE PoC Proof-of-Concept for CVE-2025-8110 , an authenticated arbitrary file write in Gogs ≤ 0.13.3 caused by improper symbolic-link handling in the PutContents API. An authenticated user can commit a symlink pointing to .git/config, then use the API to overwrite it...

binwalk

Binwalk Binwalk is a fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images. EOL notice This fork was born to fix some outsanding issues with binwalk v2 and generally to keep it in good shape. It served his purpose helping users and distro packagers alike...

MAL-014

MAL-014: Authenticated Arbitrary File Read in VMware vCenter Server The “com.vmware.appliance.version1.system.update.set” API component is vulnerable to a flag injection attack that can be leveraged with the “com.vmware.showlog” plugin in order to read arbitrary files as the “root” user on the...

CVE-2026-11111-TOCTOU-in-File-Permission-Check-Before-Open

CVE-2026-11111 – TOCTOU in File Permission Check Before Open Program Code Python toctouserver.py - File server that checks permission then opens import os, time, tempfile from flask import Flask, request app = Flaskname SAFEDIR = '/tmp/safe' @app.route'/read' def readfile: filename =...

CVE-2026-101894

A flaw was found in the @xhmikosr/decompress and decompress packages for Node.js. The default decompressinput, output API relies on lexical containment checks that do not account for the kernel following a planted symlink chain. An attacker can supply a crafted archive containing chained symlink...

path-auditor

PathAuditor PathAuditor es una herramienta diseñada para encontrar vulnerabilidades relacionadas con el acceso a archivos mediante la auditoría de funciones de libc. La idea es aproximadamente la siguiente: Auditar cada llamada a funciones libc relacionadas con el sistema de archivos realizada po...

EUVD-2026-95346

A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation os.path.abspath instead of resolving symbolic links os.path.realpath, and it performs no containment check on...

CVE-2025-4138-POC

CVE-2025-4138 - Bypass de PATHMAX en tarfile de Python PoC Autor: d3vn0mi / \ \ / / | | / \ | | | | || | / | | \ V /| | | | | | | \ | | || || / \ | | | | | ||/ /| || / / || | , | | || || ||/|/ |||/ // CVE-2025-4138 :: Python tarfile PATHMAX Bypass Author: d3vn0mi Resumen Un exploit de prueba...

CVE-2025-4517-Python-tarfile-filter-data-Bypass-PoC

CVE-2025-4517 — Python tarfile filter="data" Bypass PoC Vulnerabilidad de Path Traversal en el módulo tarfile de Python que afecta a las versiones 3.8.0 hasta 3.13.1. El sandbox filter="data" — diseñado para evitar extracciones no seguras — puede ser evadido creando rutas que exceden PATHMAX 4096...

DEBIAN-CVE-2026-89091

A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation os.path.abspath instead of resolving symbolic links os.path.realpath, and it performs no containment check on...

CVE-2026-89091

A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation os.path.abspath instead of resolving symbolic links os.path.realpath, and it performs no containment check on...

GHSA-556J-VV39-8RQV Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry

Summary In banks.registries.DirectoryPromptRegistry, prompt file paths and the index file index.json do not refuse symbolic links. When a prompt directory contains or accepts untrusted files e.g. unpacked archives, shared repositories, or multi-tenant folders, symbolic links pointing outside the...