Symlink on Łukasz Pastuszak - security noteshttps://lukaszpastuszak.dev/tags/symlink/Recent content in Symlink on Łukasz Pastuszak - security notesHugoen-usSun, 06 Sep 2026 00:00:00 +0000PermXhttps://lukaszpastuszak.dev/writeups/permx/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/permx/An unauthenticated file upload in Chamilo LMS (CVE-2023-4220) gives RCE as www-data, a reused database password reaches mtz, and a symlink-following sudo ACL script escalates to root.