Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

github логотип

GHSA-c3q7-m35p-9qq7

Опубликовано: 09 окт. 2026
Источник: github
Github: Не прошло ревью
CVSS3: 9.8

Описание

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).

EPSS

Процентиль: 46%
0.00553
Низкий

9.8 Critical

CVSS3

Дефекты

CWE-1386

Связанные уязвимости

CVSS3: 9.8
ubuntu
около 1 месяца назад

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).

CVSS3: 3.3
redhat
около 1 месяца назад

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).

CVSS3: 9.8
nvd
около 1 месяца назад

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target).

CVSS3: 9.8
msrc
29 дней назад

Root.Mkdir(All) can follow junctions out of the root on Windows in os

CVSS3: 9.8
debian
около 1 месяца назад

On Windows, when the target of Root.Mkdir or Root.MkdirAll is a juncti ...

EPSS

Процентиль: 46%
0.00553
Низкий

9.8 Critical

CVSS3

Дефекты

CWE-1386