RubyGems fails to re-validate path containment after filesystem symlink resolution during gem...
CVE-2026-82455
RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-exi
#cwe-59
共收录 498 条相关情报。
← 返回所有主题RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points out...
CVE-2026-82455
RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-exi
RubyGems before 4.0.13 Path Traversal via Symlink Resolution
CVE-2026-82455
RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-exi
aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.File...
CVE-2026-55569
aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the hand
KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote c...
CVE-2026-55108
KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.
gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can c...
CVE-2026-82252
gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-
gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_state::checkout() follows an existing terminal symlink dur...
CVE-2026-82248
gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_s
gitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodules
CVE-2026-82252
gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-
gitoxide before 0.33.0 Path Traversal via symlink following
CVE-2026-82248
gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_s
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink befo...
CVE-2026-59311
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choos
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwr...
CVE-2026-81727
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloa
openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), which in...
CVE-2026-81690
openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist s
Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without the "O_NOFOLLOW" flag. A local attac...
CVE-2026-56651
Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application open
NLTK before 3.10.3 Hardlink File Overwrite via downloader
CVE-2026-81727
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloa
verify-usb before 1.4.9 Symlink Directory Traversal Code Execution
CVE-2026-81690
openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist s
Arbitrary File Overwrite via Symlink Following in dool project
CVE-2026-56651
Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application open
In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. T...
CVE-2026-81572
In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C:
The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths.
CVE-2026-66153
The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malici...
CVE-2026-79655
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform a
Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() that allows local attackers to overwrite arbitrary files by pre-creating sym...
CVE-2026-72696
Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() that allows local a