copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows...
CVE-2026-93353
copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users
#cwe-59
共收录 498 条相关情报。
← 返回所有主题Improper link resolution before file access ('link following') vulnerability in the `tar` source plugin of Apache BuildStream running on Python < 3.12 allows malicious source ta...
CVE-2026-82331
Improper link resolution before file access ('link following') vulnerability in the `tar` source plugin of Apache BuildS
Improper link resolution before file access in the quarantine restoration process of WatchDog...
CVE-2026-92253
Improper link resolution before file access in the quarantine restoration process of WatchDog Anti-Virus 1.8.640 on Wind
Improper link resolution before file access in the quarantine restoration process of WatchDog Anti-Virus 1.8.640 on Windows allows local, low-privileged attackers to cause a qua...
CVE-2026-92253
Improper link resolution before file access in the quarantine restoration process of WatchDog Anti-Virus 1.8.640 on Wind
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to es...
CVE-2026-15815
Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plug
mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSET_DIR or ASSET_DIR_OWNER_MODE in libmport/bundle_read_install_pkg.c used path-based mpo...
CVE-2026-54587
mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSET_DIR or ASSET_DIR_OWNER_MODE
mport is the MidnightBSD Package Manager. Prior to 2.7.8, do_actual_install() in libmport/bundle_read_install_pkg.c used path-based lstat(), chown(), stat(), and chmod() operati...
CVE-2026-54576
mport is the MidnightBSD Package Manager. Prior to 2.7.8, do_actual_install() in libmport/bundle_read_install_pkg.c used
pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.check_access_permission() and then ope...
CVE-2026-86861
pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested pat
An insufficient check allowed for the overwrite of arbitrary files via a symlink.
CVE-2026-68491
An insufficient check allowed for the overwrite of arbitrary files via a symlink.
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination director...
CVE-2026-79699
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. v
qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-...
CVE-2026-55828
qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses stric
On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a pare...
CVE-2026-77179
On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may...
CVE-2026-82049
In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives con
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once ...
CVE-2026-87910
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archi
Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path co...
CVE-2026-89258
Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not
rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
CVE-2026-88016
## Summary With `-l/--links`, rclone's local backend recreates a source `.rclonelink` object as a real symlink at the de
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rc...
CVE-2026-88016
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1
rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
CVE-2026-88016
rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1
A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affe...
CVE-2026-88265
A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to
A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, inclu...
CVE-2026-88264
A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redi