The vulnerability in ubuntu-advantage-tools (formerly ubuntu-pro-client) arises from the pro collect-logs command creating or using predictable temporary file paths or user-accessible log directories without verifying file type or ownership. An unprivileged local attacker can exploit this by placing a symlink at the predictable location pointing to arbitrary root-readable files such as /etc/shadow. When a root user runs the pro collect-logs command, it follows the symlink and compresses the contents of the targeted file into the diagnostic archive, which remains readable by the attacker. This leads to unauthorized disclosure of sensitive root-owned files.

An unprivileged local attacker can gain read access to sensitive root-owned files by exploiting the symlink vulnerability, resulting in complete information disclosure of system secrets. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running the pro collect-logs command in environments where unprivileged users have access to the system, or ensure that temporary file paths and log directories are secured against symlink attacks.