https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 07:20:17 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-266452 EUVD-2026-266452 https://cve.radiocsirt.org/vuln/euvd-2026-266452 https://cve.radiocsirt.org/vuln/fkie_cve-2025-67124 <p>A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can create/replace filesystem entries in the upload destination directory (e.g., shared writable directory/volume).</p> <p>A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can create/replace filesystem entries in the upload destination directory (e.g., shared writable directory/volume).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-67124 https://cve.radiocsirt.org/vuln/ghsa-mxc8-4jqf-368q <p><strong>Affected:</strong> crates.io: miniserve</p> <p>A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can create/replace filesystem entries in the upload destination directory (e.g., shared writable directory/volume).</p> <p><strong>Affected:</strong> crates.io: miniserve</p> <p>A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can create/replace filesystem entries in the upload destination directory (e.g., shared writable directory/volume).</p> https://cve.radiocsirt.org/vuln/ghsa-mxc8-4jqf-368q