CWE-59: Link Following vulnerabilities

The mv, cp, and rm file utilities exposed within the ExtremeXOS (EXOS) shell environment fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. An attacker with low-privilege CLI access can create a symbolic link that references a privileged filesystem location and then invoke the affected utilities to read, modify, or replace security-critical files outside of their authorized scope. Under certain conditions, this may enable escalation to root-level access and persistent modification of the device software stack. Exploitation is possible remotely by an attacker holding a low-privilege account, or locally via the serial console. Extreme would like to thank Hadrien Barral (Université Gustave Eiffel) and Georges-Axel Jaloyan (French Ministry of the Interior) for responsible disclosure of their findings.

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.backup()` recursively collects files using `_collectBackupFiles()`. `_collectBackupFiles()` uses `statSync(full)`, which follows symlinks. If `data/<env>` contains a symlink to a directory outside the environment root, backup recursion follows the symlink and copies external files into `data/<env>/.backups/<backupId>/`. An attacker who can place a symlink under the environment data directory can cause backup operations to disclose files outside the environment root into backup artifacts. The issue is fixed in v5.12.2. `_collectBackupFiles()` now uses `lstatSync` instead of `statSync` and skips any entry where `isSymbolicLink()` is true. Symlinks are never traversed, so `backup()` can no longer follow a link out of the environment root and copy external files into a backup artifact.

CVE-2026-16130 is a vulnerability in nearai ironclaw versions 0.29.0 and 0.29.1 affecting the validate_path function in src/tools/builtin/path_utils.rs within the write_file component. The flaw allows link following due to improper path validation. Exploitation requires local access. A patch identified by commit 369ff3d240cf3c0787b50e1e9f182e1a06c71255 is recommended to fix the issue. Public exploit code exists but no known active exploitation in the wild has been reported.

CVE-2026-16077 is a medium severity vulnerability in AstrBot up to version 4.25.5 affecting the _normalize_rw_path function in the Filesystem Computer-Use Tool component. The flaw allows local attackers to perform link following manipulations. Exploit code has been publicly disclosed, but no vendor response or patch is available.

An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.

This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-13268.

This update includes the following RPMs: dotnet8.0: * aspnetcore-runtime-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * aspnetcore-runtime-dbg-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * aspnetcore-targeting-pack-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * dotnet-apphost-pack-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * dotnet-hostfxr-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * dotnet-runtime-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * dotnet-runtime-dbg-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * dotnet-sdk-8.0-8.0.128-1.2.hum1 (aarch64, x86_64) * dotnet-sdk-8.0-source-built-artifacts-8.0.128-1.2.hum1 (aarch64, x86_64) * dotnet-sdk-dbg-8.0-8.0.128-1.2.hum1 (aarch64, x86_64) * dotnet-targeting-pack-8.0-8.0.28-1.2.hum1 (aarch64, x86_64) * dotnet-templates-8.0-8.0.128-1.2.hum1 (aarch64, x86_64) * dotnet8.0-8.0.128-1.2.hum1.src (src) Security Fix(es): dotnet8.0: * CVE-2026-53486

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally.

Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in Windows Projected File System allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in Windows Server Backup allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.

Improper link resolution before file access ('link following') in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally.

Improper link resolution before file access ('link following') in Window PC Manager allows an authorized attacker to elevate privileges locally.

Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally.

DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers can read or write files outside of the data directory.

An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate rights by leveraging a race conditions via Symbolic Links. This issue affects Total Security: before 27.0.58.315; Internet Security: before 27.0.58.315.

Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Glarysoft Glary Utilities. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Disk Clean functionality. By creating a junction, an attacker can abuse the service to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27004.

FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the download_and_copy() function within hopper/setup.py that extracts NVIDIA toolchain archives without validating symlinks or filtering tar members. A local attacker can pre-plant a symlink in the predictable cache directory to redirect extracted binaries to an attacker-chosen location, enabling arbitrary file write with victim privileges during build time.

ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract() uses a predictable home-rooted output directory (~/ubuntu_data/ubuntu_dialogs) with a check-then-create pattern followed by tar.extractall(path=self.data_path), allowing a local attacker who pre-plants a symlink at the predictable path to cause archive contents to be written through the symlink to an attacker-chosen directory. This issue is fixed in version 1.2.14.