CVE-2026-93353 copyparty SFTP Volume Restriction Bypass via mkdir/rmdir/chattr Handlers

copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The mkdir, rmdir, and...

EUVD-2026-86466

copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The mkdir, rmdir, and...

EUVD-2026-38489

Language Servers for AWS vulnerable to arbitrary file write...

Language Servers for AWS vulnerable to arbitrary file write

Summary Language Servers for AWS the aws/language-servers project provides the Language Server Protocol implementations that power AWS developer tooling, including the Amazon Q Developer agentic chat experience, across IDEs such as VS Code, JetBrains, Visual Studio, and Eclipse. Missing symlink...

GHSA-6V3R-4P5C-MRP5 Language Servers for AWS vulnerable to arbitrary file write

Summary Language Servers for AWS the aws/language-servers project provides the Language Server Protocol implementations that power AWS developer tooling, including the Amazon Q Developer agentic chat experience, across IDEs such as VS Code, JetBrains, Visual Studio, and Eclipse. Missing symlink...

angular-cli-symlink-asset-escape-poc

Angular CLI symlink asset escape Minimal reproduction for @a...

crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown

A flaw was found in crun. After pivotroot, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed relea...

crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations...

acl: Symlink traversal privilege escalation via libacl functions

A flaw was found in the acl package, specifically within its libacl pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list ACL read or write operations to...

Important: Red Hat Security Advisory: acl security update

An update for acl is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...

CVE-2026-63343

A flaw was found in Incus, a system container and virtual machine manager. An authenticated Incus user can exploit this vulnerability by providing a malicious image containing a metadata.yaml symlink that points to an arbitrary host path. This allows the user to read or overwrite any file on the...

CVE-2026-93353: Improper Link Resolution Before File Access

copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The mkdir, rmdir, and...

abrt security update

2.1.11-60.0.7 - Fix symlink following in event handler scripts CVE-2026-54230Orabug: 40051150 2.1.11-60.0.5 - Fix TOCTOU in SetElement/DeleteElement CVE-2026-54228 Orabug: 39811882 - Fix race condition in ChownProblemDir CVE-2026-54229 Orabug: 39811882...

Apache BuildStream 2.8.0 (symlink) Arbitrary File Write

Summary BuildStream is a powerful software integration tool that allows developers to automate the integration of software components including operating systems, and to streamline the software development and production process. Description Apache BuildStream's tar source plugin extracts archive...

PT-2026-105459

sieve: symlink traversal flaw could result in arbitrary file disclosure...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124467)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124467 advisory. On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when...

Linux Distros Unpatched Vulnerability : CVE-2026-96807

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Flatpak before 1.18.1, a malicious sandboxed app can replace /.var/app/$appid/.ld.so with a symlink, causing regenerateldcache to write files at an arbitrary...

RHEL 8 : acl (RHSA-2026:71656)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:71656 advisory. Access Control Lists ACLs are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfac...

Linux Distros Unpatched Vulnerability : CVE-2026-96808

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validated file paths by...

SUSE CVE-2026-96275

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...