Exploit discussion active in current signal (3 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
Conversor from @hackthebox_eu features XSLT injection and os.path.join abuse for file write, and CVE-2024-48990 in needrestart (plus a config GTFObin) for root. https://0xdf.gitlab.io/2026/03/21/htb-conversor.html
Post summary
The post discloses a CVE‑2024‑48990 flaw involving XSLT injection and file‑write via os.path.join abuse, with details pointing to a PoC hosted on the linked blog.
HTB “Conversor” write-up: Flask app converting Nmap XML to HTML is abused via XSLT injection + os.path.join traversal to drop cron-executed Python shells, gain www-data, crack MD5 creds → fismathack, then escalate to root using CVE-2024-48990 (needrestart / PYTHONPATH). #HackTheBox #XSLT #PrivilegeEscalation #Linux #Flask https://0xdf.gitlab.io/2026/03/21/htb-conversor.html
Post summary
A HackTheBox write‑up demonstrates how a Flask app was abused with XSLT injection and path traversal to drop cron‑executed shells, then leveraged CVE‑2024‑48990 to achieve root, accompanied by a link to the full PoC.
HackTheBox - Conversor 🛤️ Path Traversal y Arbitrary File Write ⏰ Acceso inicial a traves de Cronjob para scripts Python 🔑 Credenciales en base de datos 🚀 Escalada de privilegios via CVE-2024-48990 https://sckull.github.io/posts/conversor/
Post summary
The write‑up outlines how HackTheBox's Conversor challenge leverages CVE-2024-48990 for privilege escalation, with path traversal and arbitrary file write, and provides a link to a detailed post.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | needrestart_project | needrestart | - | - | - |