This vulnerability arises from improper link resolution before file access (CWE-59) in the ubuntu-pro-client's pro collect-logs command framework. The tool uses predictable temporary file paths or user-accessible log directories without verifying file type or ownership. An unprivileged local attacker can create a symlink at a predictable path pointing to sensitive root-readable files (e.g., /etc/shadow). When a privileged user runs the pro collect-logs command, the tool follows the symlink, reads the target file, and includes its contents in the diagnostic archive, which remains readable by the attacker. This leads to complete information disclosure of system secrets.

An unprivileged local attacker can gain unauthorized read access to sensitive root-owned files by exploiting the symlink following behavior in the pro collect-logs command. This results in a confidentiality breach of critical system files such as /etc/shadow or private root files. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid running the pro collect-logs command in environments where unprivileged users can create files or symlinks in the directories used by the tool. Restrict local user permissions to prevent creation of symlinks in predictable temporary or log directories used by ubuntu-pro-client.