https://poc.intelseclab.com/tags/symlink/Latest proof-of-concept entries.Hugoen-usSat, 15 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-17106-copyescape-docker-cp-host-takeover/Sat, 15 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-15_cve-2026-17106-copyescape-docker-cp-host-takeover/Critical severity (CVSS 9.8) — binary · CVE-2026-17106. Status: Patched. Affects: Docker Engine / Docker Desktop, docker cp CLI command. Tags: docker, container-escape, race-condition, symlink, path-traversal, runc, host-takeover, linux, macos, CWE-367, CWE-59, CVE-2026-17106.binaryCriticaldockercontainer-escaperace-conditionsymlinkpath-traversalrunchost-takeoverlinuxmacosCWE-367CWE-59CVE-2026-17106https://poc.intelseclab.com/pocs/binary/2026-08-11_shieldbreak-defender-rogueplanet-patch-bypass/Tue, 11 Aug 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-08-11_shieldbreak-defender-rogueplanet-patch-bypass/High severity (CVSS 7.8) — binary · Bypass of CVE-2026-50656 (RoguePlanet); no CVE assigned to ShieldBreak as of 2026-08-11. Status: Unpatched. Affects: Microsoft Windows Defender (Antimalware Service Executable / MsMpEng.exe), threat remediation subsystem. Tags: windows, windows-defender, lpe, privilege-escalation, 0day, patch-bypass, cloud-files, cfapi, object-manager, symlink, wer, dll-sideload, CWE-59, CWE-426, microsoft, rogueplanet, shieldbreak.binaryHighwindowswindows-defenderlpeprivilege-escalation0daypatch-bypasscloud-filescfapiobject-managersymlinkwerdll-sideloadCWE-59CWE-426microsoftrogueplanetshieldbreakhttps://poc.intelseclab.com/pocs/misc/2026-07-06_cve-2025-4517-tarfile-filter-data-path-max-bypass/Mon, 06 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-06_cve-2025-4517-tarfile-filter-data-path-max-bypass/Critical severity (CVSS 9.4) — misc · CVE-2025-4517. Status: Weaponized. Affects: Python standard library tarfile module — filter="data" / filter="tar" extraction filters (PEP 706). Tags: python, tarfile, path-traversal, sandbox-bypass, path_max, realpath, symlink, cwe-22, stdlib.miscCriticalpythontarfilepath-traversalsandbox-bypasspath_maxrealpathsymlinkcwe-22stdlibhttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-29786-node-tar-symlink-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-29786-node-tar-symlink-traversal/High severity — misc · CVE-2026-29786. Status: PoC. Affects: tar npm package (Node.js). Tags: node-tar, path-traversal, symlink, archive-extraction, arbitrary-file-write, nodejs, supply-chain.miscHighnode-tarpath-traversalsymlinkarchive-extractionarbitrary-file-writenodejssupply-chainhttps://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-23745-node-tar-path-traversal/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-23745-node-tar-path-traversal/High severity — misc · CVE-2026-23745 / GHSA-8qq5-rm4j-mr97. Status: PoC. Affects: node-tar (npm package tar). Tags: node-tar, path-traversal, arbitrary-file-overwrite, hardlink, symlink, supply-chain, nodejs, tar-archive.miscHighnode-tarpath-traversalarbitrary-file-overwritehardlinksymlinksupply-chainnodejstar-archivehttps://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-54420-litespeed-symlink-lpe/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/network/2026-07-05_cve-2026-54420-litespeed-symlink-lpe/High severity (CVSS 8.5) — network · CVE-2026-54420. Status: PoC. Affects: LiteSpeed cPanel Plugin / WHM Plugin. Tags: litespeed, cpanel, whm, symlink, cwe-61, cloudlinux, cagefs, shared-hosting, ftp, privilege-escalation.networkHighlitespeedcpanelwhmsymlinkcwe-61cloudlinuxcagefsshared-hostingftpprivilege-escalationhttps://poc.intelseclab.com/pocs/binary/2026-06-26_cve-2026-50656-rogueplanet-checker/Fri, 26 Jun 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/binary/2026-06-26_cve-2026-50656-rogueplanet-checker/High severity (CVSS 7.8) — binary · CVE-2026-50656. Status: Researched. Affects: Microsoft Malware Protection Engine (mpengine.dll, MsMpEng.exe). Tags: LPE, Windows Defender, TOCTOU, symlink, reparse-point, junction, CWE-59, checker, detection, non-destructive, MsMpEng.binaryHighLPEWindows DefenderTOCTOUsymlinkreparse-pointjunctionCWE-59checkerdetectionnon-destructiveMsMpEnghttps://poc.intelseclab.com/pocs/web/2026-05-30_litespeed-user-end-cpanel-plugin-privesc/Sat, 30 May 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-05-30_litespeed-user-end-cpanel-plugin-privesc/High severity — web · CVE-2026-48172. Status: Patched. Affects: LiteSpeed cPanel Plugin. Tags: local-privilege-escalation, cPanel, LiteSpeed, symlink, archive-extraction.webHighlocal-privilege-escalationcPanelLiteSpeedsymlinkarchive-extraction