Rule Explorer

$PKG is required or locked at $VER, a release of the cap-std filesystem sandbox family affected by CVE-2026-115392 (fixed in 4.0.3). On macOS and on Linux kernels without openat2(), the userspace containment fallback mishandles a symlink traversed through a trailing-slash path component, so a sandboxed guest can read and write host files outside the sandbox.

A symlink is created on the local filesystem whose target comes from a remote peer ($SFTP.ReadLink) without recording the created link for containment. A malicious server can plant such a symlink early in a recursive transfer and then have the client follow it when creating or writing later entries of the same transfer (os.Mkdir, os.OpenFile with O_CREATE/O_

GoCVE-2026-115378CWE-59

`btrfs receive` is executed without the `--chroot` confinement flag. The receiver runs with the privileges of the storage daemon (typically root) and resolves the path and subvolume references embedded in the send stream it reads, so a malicious migration/backup source can plant entries such as a `rootfs -> /` symlink and have arbitrary host files created or

GoCVE-2026-115377CWE-22CWE-59

A repository-controlled git tree entry path is written into the working tree after only name-level validation. The validate_path() check (and stat bookkeeping such as os.lstat(full_path) of the final component) has no knowledge of the real filesystem, so intermediate directory symlinks are accepted: an entry such as "link/post-checkout" while the worktree co

PythonCVE-2026-114098CWE-22CWE-59

build_index_from_tree() is called with the process current working directory ($ROOT) as root_path, so every entry of the given git tree — including symlink entries (mode 120000) whose attacker-controlled target blob is passed straight to os.symlink() — is materialized into the CWD and left on disk. In iterative operations over untrusted history (e.g. a filte

PythonCVE-2026-114097CWE-22CWE-59

A file is opened for writing with os.open() using O_TRUNC create/clobber flags but without O_NOFOLLOW (or O_EXCL). os.open follows a symlink that already exists at $PATH, so content written through the returned file descriptor is truncated-and-written to the symlink's target, which can be outside the intended directory (CWE-59/CWE-61 symlink following / arbi

PythonCVE-2026-114096CWE-59CWE-61

An attacker-influenceable filesystem path reaches sqlite3.connect() by name. SQLite opens and, with creation semantics, creates whatever the final path component points to at each connect, so a local attacker who can create names in the database directory can plant a symbolic link (redirecting database creation and locking, or splitting mutual exclusion betw

PythonCVE-2026-112936CWE-367CWE-59

$OPEN opens $PATH in write mode ($FLAGS) resolved purely by name and then the descriptor is written, but the open is not anchored to a vetted directory fd (no dir_fd=), is not non-blocking (no O_NONBLOCK, so a planted named pipe stalls the open forever), and the enclosing function never re-checks the descriptor's kernel identity with os.fstat (S_ISREG / st_d

PythonCVE-2026-112934CWE-367CWE-59

This code moves a path aside with os.rename/Path.rename and later restores it by name with os.link without follow_symlinks=False. The original pathname stands empty between the rename-aside and the restore, so a local user with write access to the directory can create their own file at the emptied name (breaking mutual exclusion) or swap a symbolic link in a

PythonCVE-2026-112914CWE-367CWE-59

A path-containment (allow) decision is computed purely lexically: a candidate path is compared against a root directory with os.path.commonpath([ROOT, PATH]) == ROOT (any operand order, root compared directly or via str(...)), while the deciding function never resolves symlinks - no os.path.realpath/realpath, no Path.resolve, and no symlink-escape guard such

PythonCVE-2026-109965CWE-59

Archive extractor materialises attacker-controlled symlink entries and writes regular entries with a symlink-following open (O_CREATE without O_EXCL/O_NOFOLLOW) in the same routine. A symlink entry placed before a regular-file entry redirects the write outside the staging tree (e.g. into a live configuration path), enabling persistent configuration injection

GoCVE-2026-107810CWE-59CWE-61

An authentication credential is built from a browser-ambient source (an HTTP cookie or a URL query parameter) and returned for request authentication. Browsers automatically attach cookies to cross-site requests, so every endpoint that trusts this token is vulnerable to cross-site request forgery (CWE-352): a remote attacker page can make a logged-in adminis

GoGinCVE-2026-107809CWE-352CWE-598

Tar archive is extracted without a containment-enforcing member filter. On Python < 3.14, TarFile.extractall()/extract() default to the "fully_trusted" filter, which does not reject members that escape the destination. Checking only member.name is not enough: a symlink or hard-link member whose linkname points outside the extraction directory, followed by a

PythonCVE-2026-104103CWE-22CWE-59

A root-privileged recursive `chown -R` runs on a path whose only symlink protection is an is_link() test on the final path component. Intermediate path components can be swapped for symlinks (e.g. <docroot>/backup -> /etc), or a link target can resolve outside the sanctioned root via unresolved '..' segments, so the recursive ownership change follows the lin

PHPCVE-2026-100716CWE-22CWE-59

Privileged filesystem mutation (write/chmod/chown/chgrp) on a path derived from a customer-controlled home directory without a containment re-check guarding the flow. The path string is validated only at derivation time; PHP re-resolves the path and follows symlinks when the operation executes, so a local user who controls the home directory can swap in a sy

PHPCVE-2026-100713CWE-367CWE-59

File read/served from a request-derived workspace path that was never resolved through symlinks or Windows junctions. The logical path is only validated lexically (util.GetAbsPathInWorkspace rejects ".." escapes) and the authorization checks ran on the unresolved path, so the OS open follows a link pointing outside the workspace and its target bytes are disc

GoGinCVE-2026-85583GHSA-G7GF-V79M-JWRMGHSA-g7gf-v79m-jwrmCWE-22

A destructive, root-privileged filesystem operation (os.Remove, os.Rename, recursive deleteSubvolume, or setReceivedUUID) targets a precomputed subvolume destination from the copyOps loop ($OP.dest) or a destination built inline by joining a privileged volume mount path with an externally decoded subvolume path. Those destinations originate from attacker-inf

GoCVE-2026-85526CWE-22CWE-23CWE-59

Pathname-based permission or ownership operations (chmod, chown, lchown) on FTS traversal entries (fts_path or fts_accpath) are vulnerable to TOCTOU symlink races. An attacker with write access to the traversed directory can replace the entry with a symlink before chmod/chown runs, leading to unauthorized modification of arbitrary files. Instead, open the fi

CCVE-2026-82430CWE-367CWE-59CWE-732

Using `Path.rglob()` for file integrity verification or manifest creation does not descend into symlinked directories and can allow planted files beneath symlinks to evade detection. Enumerate the directory tree using `os.walk(..., followlinks=False)` and explicitly validate or reject symlinks using `os.path.islink()`.

PythonCVE-2026-81690CWE-59

A redirect Location that embeds an issued credential (access/JWT token) and user identity is sent with a raw HttpServletResponse.sendRedirect(). In an SSO flow (OIDC/OAuth2/SAML) whose redirect target originates from a caller-supplied callback parameter (?redirectUri= / ?callback= / RelayState) and is only checked after the token is minted, the server delive

JavaCVE-2026-81029CWE-598CWE-601

Tar members are extracted with every tarfile protection disabled: extraction_filter is set to tarfile.fully_trusted_filter (or to a pass-through lambda, the fallback used on Pythons that ignore the attribute). tarfile will then faithfully create symlink/hardlink members whose targets are absolute or escape the destination ('../'), and later regular-file memb

PythonCVE-2026-79655CWE-22CWE-59

Direct use of `open_tree()` may follow symlinks in leading path components, leading to TOCTOU and symlink redirection vulnerabilities. Consider pinning the path using `openat2()` with `RESOLVE_NO_SYMLINKS` before mounting or cloning trees.

CCVE-2026-78410CWE-367CWE-59

Calling open_tree() with AT_SYMLINK_NOFOLLOW does not prevent intermediate symlink traversal or escaping the target directory tree. Use openat2() with RESOLVE_BENEATH and RESOLVE_NO_SYMLINKS or a safe path resolution helper instead.

CCVE-2026-78409CWE-22CWE-59

A path-containment (allow-list) decision is made with str.startswith() against a trusted root that has no trailing path-separator boundary and is not resolved with os.path.realpath. A requested path that merely shares the root as a string prefix (e.g. /data/images vs /data/images-backup) is therefore trusted (CWE-22), and a symlink placed inside the root nor

PythonCVE-2026-77815CWE-22CWE-59