The vulnerability CVE-2026-56815 affects pwnlift before commit d7a9544 in the rasta-mouse project. It is a UNIX symbolic link following vulnerability (CWE-61) located in the upload handler within Components/Pages/Home.razor. This flaw allows an attacker to potentially exploit symlink behavior in a privileged deployment context, leading to unauthorized access or modification of files. The CVSS 3.1 base score is 7.4, reflecting high impact on confidentiality, integrity, and availability, with attack vector local, high attack complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability can result in full compromise of confidentiality, integrity, and availability of the affected system due to symlink following in a privileged upload handler. This could allow an attacker to access or modify sensitive files or execute unauthorized actions on the system where pwnlift is deployed with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published. Until a patch is available, avoid deploying pwnlift in privileged contexts or restrict access to trusted users only.