CVE-2026-75038: CWE-61 UNIX symbolic link (symlink) following in ilya-zlobintsev LACT

The vulnerability identified as CVE-2026-75038 in the ilya-zlobintsev LACT project is a UNIX symbolic link (symlink) following issue classified under CWE-61. It permits a local attacker with low privileges to cause a denial-of-service (DoS) condition by exploiting the way the software handles symlinks. The affected versions include all releases through 0.10.0. The CVSS v3.1 base score is 6.1, reflecting local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.

A local attacker can exploit this vulnerability to cause a denial-of-service condition on systems running affected versions of LACT. There is no impact on confidentiality, a low impact on integrity, and a high impact on availability. No known exploits are reported in the wild.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users and monitor for attempts to exploit symlink handling.