skip to content
~/bokkapig
_
hack the box machine writeups
[1]
machines
[2]
refs
[3]
cheatsheet
[4]
search
[5]
pdf-inject
← cd ../tags
grep -l "Fonttools" ./machines
[1]
sorted: date ▼
$ grep
/
difficulty
medium
clear ✕
name
diff
os
date
tags
VariaType
medium
linux
2026-03-14
Exploited fonttools CVE-2025-66034 designspace path traversal to write a PHP webshell, escalated to user via FontForge archive command injection, then root via setuptools PackageIndex arbitrary file write to cron.d.
fonttools
·
cve-2025-66034
·
path-traversal
·
php-injection
·
lfi
·
git-exposure
·
+5
no machines match that filter
