Alertas de Seguridad de la Información

M Alto vulnerabilidad

14/07/2026

[CVE-2026-15392] DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrust…

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers c…

nvdaltovulnerabilidad CVSS 7.7 NVD

O Alto vulnerabilidad

13/07/2026

[CVE-2026-62189] OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync featu…

OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower-trust callers to perform actions requiring stronger authorization. Attackers can exploit remote symlink parents to bypass policy checks and authorization boundaries when the feature is enabled and reachable.

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

13/07/2026

[CVE-2026-15684] Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability. This vulnerabilit…

Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Glarysoft Glary Utilities. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Disk Clean functionality.…

nvdaltovulnerabilidad CVSS 7.3 NVD

D Alto vulnerabilidad

09/07/2026

[CVE-2026-39246] decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing…

decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries (type === 'symlink'), the x.linkname field from the archive is passed directly to fs.symlink() without validation (index.js line 121). The preventWritingThroughSymlink check on line 98 only applies to file entries, not symlink creation. An attacker can craft an archive with symlink …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

08/07/2026

[CVE-2026-14891] HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver th…

HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host. This vulnerability, CVE-2026-14891, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.…

nvdaltovulnerabilidad CVSS 8.7 NVD

M Alto vulnerabilidad

03/07/2026

[CVE-2026-57991] Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) al…

Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

nvdaltovulnerabilidad CVSS 7.4 NVD

D Alto vulnerabilidad

01/07/2026

[CVE-2026-41121] Dell Device Management Agent, versions prior to DDMA 26.05, contain an Improper Link Resolution Befo…

Dell Device Management Agent, versions prior to DDMA 26.05, contain an Improper Link Resolution Before File Access ('Link Following’) vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.

nvdaltovulnerabilidad CVSS 7.3 NVD

A Alto vulnerabilidad

29/06/2026

[CVE-2026-55607] Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling a…

Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and git fsmonitor execution during worktree operations, an attacker could overwrite files in the user's home directory (such…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-54369] acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based fun…

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read …

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

29/06/2026

[CVE-2026-54371] attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr ut…

attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to lo…

nvdaltovulnerabilidad CVSS 7.1 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-55667] File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing…

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.16, a scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope (other tenants' data, and the application's own database) via the upload failure-cleanup path. ScopedFs.RemoveAll is the one …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

25/06/2026

[CVE-2026-54094] File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing…

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.14, it does not stop the HTTP file handlers from following symbolic links before they open, serve, write, share, or list a file. As a result, a scoped user — and in some cases an unauthenticated public-share recipient — can cross the intended scope …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

24/06/2026

[CVE-2026-23879] py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encr…

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Versions 1.1.2 and below contain an an arbitrary file write vulnerability, which allows symbolic links to be recreated outside the destination directory via crafted malicious symbolic link chains. When using extractall to extract an archive, the library restores these symbolic…

nvdaltovulnerabilidad CVSS 8.0 NVD

P Alto vulnerabilidad

24/06/2026

[CVE-2026-35025] ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows aut…

ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/root in the RNFR command handler. Attackers can exploit the unresolved symlink components in dir_canonical_path() to cause dir_check() to perform lexical path comparisons that match no configured Directo…

nvdaltovulnerabilidad CVSS 8.1 NVD

D Alto vulnerabilidad

22/06/2026

[CVE-2026-44274] Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution Be…

Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution Before File Access vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

nvdaltovulnerabilidad CVSS 7.8 NVD

M Alto vulnerabilidad

16/06/2026

[CVE-2026-50656] Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Micros…

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ".

nvdaltovulnerabilidad CVSS 7.8 NVD

A Alto vulnerabilidad

13/06/2026

[CVE-2026-54230] A symlink following vulnerability was found in the ABRT post-create event handler scripts in librepo…

A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write output files using shell redirections without the O_NOFOLLOW flag. If the target file is replaced with a symlink, the shell process running as root follows the symlink and writes content to the symlink target, allowing arbitrary file overwrites on the system.

nvdaltovulnerabilidad CVSS 7.0 NVD

K Alto vulnerabilidad

12/06/2026

[CVE-2026-54056] Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow …

Kitty is a cross-platform GPU based terminal. In versions 0.47.0 and 0.47.1, `kitten dnd` can allow a malicious remote drag-and-drop source to overwrite or truncate arbitrary files writable by the local kitty user. Remote `text/uri-list` drops are staged in a temporary directory, but on case-sensitive filesystems duplicate remote basenames are not de-duplicated. An attacker can first create a stag…

nvdaltovulnerabilidad CVSS 7.6 NVD

M Alto vulnerabilidad

10/06/2026

[CVE-2026-11837] A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The…

A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator ru…

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

09/06/2026

[CVE-2026-50511] Improper link resolution before file access ('link following') in Microsoft PC Manager allows an aut…

Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.

nvdaltovulnerabilidad CVSS 7.8 NVD