CWE-59: Link Following vulnerabilities

CVE-2026-67433 is a medium severity vulnerability in Linuxfabrik monitoring-plugins version 6.0.0. It involves improper link resolution before file access, where a local user controlling the plugin account can create a symbolic link in a predictable /tmp path. This symlink is followed by sqlite3.connect() during a root-run check, potentially leading to unauthorized file access or modification.

CVE-2026-13268 is a local privilege escalation vulnerability in G DATA Total Security version 25.5.19.439. It arises from improper link resolution in the Backup Service, allowing an attacker with low-privileged code execution to create a symbolic link that causes the service to delete arbitrary files. Exploiting this flaw can lead to arbitrary code execution with SYSTEM privileges.

CVE-2026-13723 is a path traversal vulnerability in Develar's app-builder affecting versions up to 4.2.0. It arises from improper handling of Unicode normalization in the zipx.Unzip extraction routine on macOS APFS. An attacker can craft a ZIP archive with a symlink named 'ss' and a file named 'ß' that exploits APFS's Unicode equivalence to overwrite arbitrary files by following the symlink during extraction.

CVE-2026-12503 is a critical vulnerability in Loytec LIP-ME20xC devices running L-INX up to version 8.4.16 on LINX-A64. It involves improper link resolution in the /usr/bin/larm_starter component, allowing an authenticated attacker with larmapp group privileges to exploit a symlink attack on /etc/lighttpd/ssl/server.pem. This attack can make /etc/passwd writable by the larmapp group, potentially leading to root privilege escalation.

Data::DisjointSet::Shared versions before 0.02 for Perl create a world-readable mmap backing file with insecure permissions and open flags. The file is created with mode 0666 (resulting in 0644 after umask), making it world-readable. The open call lacks O_EXCL and O_NOFOLLOW flags, allowing a local attacker to exploit symlink following and pre-creation race conditions in shared directories like /tmp or /dev/shm. This can lead to unauthorized local read access to IPC payloads.

Data::SpatialHash::Shared versions before 0.02 for Perl create a memory-mapped backing file with overly permissive permissions (world-readable) and open it without safeguards against symlink attacks or race conditions. This allows local users to read inter-process communication payloads and potentially manipulate the file open operation by pre-creating files or symlinks at the target path.

Data::Intern::Shared versions before 0.02 for Perl create a memory-mapped file with overly permissive permissions (world-readable) and open it without secure flags, allowing local users to read sensitive IPC data or exploit race conditions via symlink attacks. The file is created with mode 0666 but typically results in 0644 permissions due to umask, and lacks O_EXCL and O_NOFOLLOW flags, enabling pre-creation races and symlink following in shared directories like /tmp or /dev/shm.

Data::RingBuffer::Shared versions before 0.04 for Perl create a memory-mapped backing file with world-readable permissions and open it without using secure flags O_EXCL or O_NOFOLLOW. This allows local users to read inter-process communication payloads stored in the shared segment and enables local attackers to exploit race conditions or symlink attacks to redirect file access. The vulnerability arises from incorrect permission assignment and insecure file opening practices in a shared directory.

Data::RoaringBitmap::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in roaring.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing. A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.

Data::HashMap::Shared versions before 0.14 for Perl create a world-readable memory-mapped file without exclusive or no-follow flags, allowing local users to read IPC payloads and potentially exploit symlink or pre-creation race conditions in shared directories like /tmp or /dev/shm.

Data::RadixTree::Shared versions prior to 0.02 for Perl create a memory-mapped file with overly permissive permissions (world-readable) and open it without safeguards against symlink attacks or race conditions. This allows local users to read inter-process communication data and potentially exploit pre-creation or symlink redirection attacks. The vulnerability arises from the use of open() with mode 0666 and missing O_EXCL and O_NOFOLLOW flags.

Data::SortedSet::Shared versions before 0.03 for Perl create a memory-mapped backing file with overly permissive permissions (world-readable) and open it without secure flags O_EXCL or O_NOFOLLOW. This allows local users to read sensitive IPC payloads and potentially exploit race conditions or symlink attacks by pre-creating or redirecting the backing file in shared directories like /tmp or /dev/shm.

Data::ReqRep::Shared versions before 0.05 for Perl create a world-readable memory-mapped backing file with insecure permissions and open flags. The file is created with mode 0666 (resulting in 0644 after umask), making it world-readable. The open call lacks O_EXCL and O_NOFOLLOW flags, allowing symlink following and pre-creation race conditions. This can lead to local users reading IPC payloads or redirecting the open to attacker-controlled files in shared directories like /tmp or /dev/shm.

Data::PubSub::Shared versions before 0.07 for Perl create a memory-mapped file with overly permissive permissions (world-readable) and open it without safeguards against symlink attacks or race conditions. This allows local users to read inter-process communication payloads and potentially exploit pre-created files or symlinks to redirect file operations.

Data::NDArray::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in ndarray.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing. A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open.

Data::Graph::Shared versions before 0.04 for Perl create a memory-mapped backing file with insecure permissions (world-readable) and open it without safeguards against symlink attacks or pre-existing files. This allows local users to read inter-process communication payloads and potentially exploit race conditions or file redirection in shared directories like /tmp or /dev/shm.

Data::Deque::Shared versions before 0.06 for Perl create a memory-mapped file with insecure permissions (world-readable) and open it without exclusive or no-follow flags. This allows local users to read IPC payloads and potentially exploit race conditions or symlink attacks in shared directories like /tmp or /dev/shm. The vulnerability is classified as CWE-732 (Incorrect Permission Assignment) and CWE-59 (Link Following).

Data::Buffer::Shared versions before 0.05 for Perl create a world-readable memory-mapped file without using the O_NOFOLLOW flag. This allows local users to read IPC payloads stored in the shared segment and potentially redirect file operations via symlinks. The vulnerability arises from incorrect permission assignment and lack of symlink protection when creating the backing file in shared directories like /tmp or /dev/shm.

Sparkle is a software update framework for macOS. Prior to version 2.9.2, `Autoupdate/SUBinaryDeltaApply.m` enforces `relativePath.pathComponents containsObject:@".."` and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative path. `Autoupdate/SPUSparkleDeltaArchive.m`'s `extractItem:` will create symlinks in the destination tree from archive content (no `..` check on the symlink target), and a subsequent `Extract` item targeting `<symlink>/foo/bar` then escapes the destination tree via `fopen(path, "wb")` because the kernel resolves the intermediate symlink during the open call. This is a defense-in-depth issue: exploitation requires a maliciously-crafted `.delta` that passes EdDSA signature verification, i.e. EdDSA private-key compromise. With the AppInstaller running as root for system-domain installs, it gives the holder of a stolen signing key arbitrary file write at root level via the delta-apply path, which is a strictly broader primitive than the "drop-in replacement bundle" install they would otherwise have. Version 2.9.2 contains a patch for the issue.

BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory junctions placed inside the cache root. A build authored by an untrusted user on a WCOW-configured BuildKit daemon can read arbitrary host files reachable to the BuildKit daemon process.