CopyEscape-CVE-2026-17106

CopyEscape：利用 docker cp 接管 Docker 主机（CVE-2026-17106） 这是博客文章 CopyEscape：利用docker cp 接管 Docker 主机 — CVE-2026-17106 的概念验证（PoC）仓库。 CopyEscape 可让恶意运行的容器与 Docker 的归档生成器竞争，从而创建不一致的 tar 流。随后，存在漏洞的 Docker CLI 会在提取过程中跟随被植入的符号链接，并写入运行 docker cp 的用户所选本地目标之外的位置。 该仓库包含两个演示： macos/ 包含一个非破坏性的 Docker Desktop 演示，它...

CVE-2026-64824-PoC

CVE-2026-64824 — Home Assistant Core 备份-恢复 符号链接路径遍历 → RCE CVSS 8.4（严重） · GHSA-cwh8-w64c-4j5h · CWE-22 / CWE-59 TL;DR 经过身份验证的（管理员）攻击者上传精心构造的备份 tar 包。恢复路径使用 filter="fullytrusted" 解压内部的 homeassistant.tar.gz，并且只校验成员的 名称 — 从不校验 SYMTYPE 的 链接名 。指向绝对路径（例如 Python 的 site-packages/）的符号链接会被保留，因此随后写入的...

Tarmageddon-CVE-2025-62518-

Tarmageddon CVE-2025-62518 Video: https://youtu.be/EYBB4BHsp9E リポジトリのディレクトリ vulnerable-extract 最小限の再現可能な例、引数としてパスを受け取り、そのファイルを ./output に抽出します malicious-payload 簡単な malicious.tar アーカイブを作成し、密輸されたコンテンツの例を示します。コメントでステップごと、ブロックごとの動作を説明しています 再現方法 提供されている 再現スクリプト を使用するか、手動で行います malicious-payload...

POC-CopyEscape-CVE-2026-17106

CopyEscape — CVE-2026-17106 的 PoC 关于 CopyEscape （CVE-2026-17106）的教育性概念验证（PoC），这是 docker cp 中的一个 TOCTOU 竞态条件漏洞，允许恶意容器在 Docker 主机上写入任意文件。灵感来自 masasron 的原创研究，他在博客 "CopyEscape: Taking Over Docker Hosts with docker cp" 中发现了该漏洞并进行了记录。 目录 1. 执行摘要 2. 法律声明 3. 攻击链架构 4. 环境要求 5. 仓库结构 6. 快速使用指南 7. 漏洞利用验证 8...

NodeJS-Tar-Symlink-Exploit-CVE-2026-29786

📦 CVE-2026-29786：Node.js Tar 符号链接漏洞 -yellow 📌 执行摘要 本仓库记录了针对 CVE-2026-29786 的研究，这是流行的 Node.js tar 包中发现的一个高危漏洞。该漏洞允许攻击者创建一个恶意 tar 归档文件，在解压时利用符号链接 覆盖预期解压目录之外的文件（路径遍历）。 🔍 技术分析 该漏洞存在于 tar 解压引擎验证文件路径的方式中。通过构造一个带有 type: 'symlink' 的头部，攻击者可以将链接指向敏感位置（例如 /etc/shadow 或应用程序配置文件），并在解压过程中随后覆盖该文件。 攻击机制： 1. 归档创建...

npm-tar-path-traversal-scanner

CVE-2026-31802 — npm tar 路径遍历扫描器 检测存在 CVE-2026-31802 漏洞的 npm 软件包，该漏洞是 tar npm 软件包中的一个路径遍历漏洞，允许在归档解压过程中写入任意文件。 功能特性 扫描 package-lock.json 中的易受攻击的 tar 版本 检查 nodemodules 中已安装的易受攻击软件包 使用特制的 tar 归档测试解压行为 识别导致易受攻击 tar 的依赖链 支持批量扫描多个项目 生成 JSON/CSV 报告 提供修复建议 安装 root@kitploit: git clone...

CVE-2025-4517-PoC

CVE-2025-4517-PoC CVE-2025-4517 は、Python の tarfile モジュールにおける脆弱性であり、信頼されていない tar アーカイブを展開する際に、展開先ディレクトリの外部へ任意のファイル書き込みを許可します。この問題は、フィルター "data" または "tar" を使用した TarFile.extract または TarFile.extractall を使用する場合に発生します。これらのフィルターは、細工された tar メンバーによるパストラバーサルを完全には防ぎません。 Python 3.14 では、デフォルトの展開フィルターが "data"...

CVE-2026-17106

A flaw was found in moby/go-archive. The tar extraction routines in the component do not properly restrict filesystem operations to the intended destination directory. An attacker who controls the contents of an archive can exploit this by including symbolic links, allowing them to create or...

GO-2026-6253 moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive

moby/go-archive: Crafted tar archive can write outside the extraction directory in github.com/moby/go-archive...

AZL-98211 CVE-2026-79655 affecting package sos 4.6.1-2

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

CVE-2026-79655

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

CVE-2026-79655

A path traversal flaw in the sos clean utility (part of the sos package) allows a local attacker to perform arbitrary file creation or overwrite . The root cause is improper validation of symlink and hardlink targets during tar archive extraction. A specially crafted tar archive can cause files t...

EUVD-2026-65492

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

CVE-2026-79655 Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

CVE-2026-79655

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

CVE-2026-79655

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink target...

Linux Distros Unpatched Vulnerability : CVE-2026-79655

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By...

Astra Linux – Vulnerability in python-pip

When extracting a tar archive, pip may not check symbolic links pointing into the extraction directory if the tarfile module does not implement PEP 706. Note that upgrading pip to a “fixed” version does not fix all vulnerabilities that are mitigated by using a Python version that implements PEP...

Astra Linux – Vulnerability in node-tar

The npm package “tar” also known as node-tar in versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has an arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent the extraction of absolute file paths by converting absolute paths into relative...

BIT-DOCKER-CLI-2026-17106 Tar extraction in moby/go-archive can write outside the destination directory via link following

The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical string checks and then performs the...