Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path
CVE-2026-59944
## Summary A malicious or compromised Composer package could, when installed as a dependency, cause Composer to change
#cwe-59
共收录 498 条相关情报。
← 返回所有主题Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
## Summary Dulwich's `porcelain.checkout(paths=[...])` code path writes files using raw `os.open(file_path, O_WRONLY|O_
Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence
## Summary Dulwich's `filter_branch.py` `CommitFilter._apply_index_filter()` is vulnerable to symlink directory travers
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
## Summary Dulwich's `stash.py:pop()` function is vulnerable to symlink directory traversal, allowing an attacker to wr
Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to version 1.11.0, `gh teacher download` clones each student's ass...
CVE-2026-94620
Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to versio
Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download)
CVE-2026-94620
Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to versio
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays...
CVE-2026-103263
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the
Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink
CVE-2026-103263
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the
A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service account to escalate to root privileg...
CVE-2026-102118
A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a lo
A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to ...
CVE-2026-102113
A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an
Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log...
CVE-2026-81310
Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system whe
Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is installed may overwrite arbitrary files...
CVE-2026-81310
Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system whe
@xhmikosr/decompress: Path traversal via symlink chain
CVE-2026-101894
### Impact When extracting an untrusted archive with the default `decompress(input, output)` API, a crafted archive con
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, ca...
CVE-2026-12345
The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during
Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticate...
CVE-2026-102242
Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validation in Google MCP Toolbox for Databases
Path Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases
CVE-2026-102242
Improper link resolution (CWE-59 / CWE-22) in the allowedLocalRoots path validation in Google MCP Toolbox for Databases
TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploitin...
CVE-2026-92371
TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the
The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexical containment checks that do not acco...
CVE-2026-101894
The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output)
@xhmikosr/decompress: Path traversal via symlink chain
CVE-2026-101894
The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output)
Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client...
CVE-2026-87799
Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later (fixed in 4.0.14, 5.0.10,