CVE-2026-108723: Improper Link Resolution Before File Access ('Link Following') in QingYunA answer-me-with-html

CVE-2026-108723 describes a link following vulnerability in the answer-me-with-html product by QingYunA, affecting versions up to and including 0.5.0. The vulnerability arises because the localPath() function used in the am CLI code block src= embedding does not resolve symbolic links before file access. An attacker can supply a repository containing a symlink that points outside the checked-out directory. When the am render process embeds content, it may include readable external files via these symlinks into the generated HTML output, leading to unintended information disclosure.

This vulnerability allows an attacker to cause the application to embed and disclose arbitrary files from outside the intended repository directory into generated HTML content. This can lead to information disclosure of local files accessible to the user running the tool. The CVSS score is low (2.0), indicating limited impact and exploitability requiring local access and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid rendering untrusted repositories that may contain malicious symlinks or manually verify and sanitize input repositories to prevent symlink-based path traversal.