The Garmin WDU devices running versions v1 1.4.6 and v2 5.0 serve a local website that improperly handles symbolic links in uploaded graphics packages. When such a package containing symlinks is uploaded, the web server follows these links without restricting their targets to a safe directory, allowing an attacker to access arbitrary files on the device. This lack of path restriction constitutes a symlink attack vulnerability. No official remediation or patch information is currently available, and the vulnerability has not been assigned a CVSS score.

An attacker who can upload a malicious graphics package to the Garmin WDU device can exploit this vulnerability to retrieve arbitrary files from the device's filesystem. This could lead to unauthorized disclosure of sensitive information stored on the device. There is no information about further impact such as code execution or device compromise. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device's upload functionality to trusted users only and monitor for suspicious uploads. Avoid uploading untrusted graphics packages to the affected Garmin WDU devices.