HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the client host. This vulnerability (CVE-2026-107347) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.
CVE-2026-115713 is a vulnerability in Elastic Cloud Enterprise (ECE) versions 4.1.0 through 4.2.0 involving improper link resolution before file access (CWE-59). This flaw allows an attacker with high privileges to exploit symbolic link (symlink) attacks, potentially gaining unauthorized read and write access to data belonging to other deployments on the same host.
CVE-2026-115709 is a vulnerability in Elastic Cloud Enterprise (ECE) involving improper link resolution before file access (CWE-59). This flaw allows an attacker with high privileges to exploit symbolic link (symlink) attacks, potentially leading to unauthorized disclosure and loss of data from other deployments on the same host. The vulnerability affects multiple versions of ECE from 2.6.0 through 3.8.5 and from 4.0.0 through 4.2.0. It has a high severity rating with a CVSS score of 8.2.
CVE-2026-115708 is a vulnerability in Elastic Cloud Enterprise (ECE) involving improper link resolution before file access (CWE-59). This flaw allows an attacker with high privileges to bypass authentication and make unauthorized configuration changes to other deployments on the same host by exploiting symbolic link (symlink) attacks.
MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-created output directory and follow symlinks in it, letting local users redirect attachment writes.
Each message is written to a directory named msg-<time>-<pid>-<n> under the output base, and an existing directory of that name is used as is. A file name counts as unused when nothing exists at that path, which holds for a dangling symlink, and the body file is then opened in a way that follows the link.
When the output base is writable by other users, as with output_under("/tmp"), a local user can pre-create the directory with a symlink named like an attachment. The parser then writes the attachment to the link target with the privileges of the parsing process.
CVE-2026-103401 is a high-severity vulnerability in Juniper Networks Session Smart Router and Session Smart Conductor. It involves improper link resolution before file access in unauthenticated web server handlers, allowing a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints. This affects Mist-managed routers and unmanaged routers not onboarded to a Conductor. Routers managed by Conductor are not vulnerable. Fixed versions are 7.0.5, 7.1.7, and 7.2.3.
CVE-2026-6064 is a link following vulnerability in the Data Shredder components of Norton Antivirus, Avast Antivirus, and AVG Internet Security on Windows. It affects versions prior to 26.5.10933 and allows a local, low-privileged attacker to escalate privileges to SYSTEM by enabling arbitrary file or folder deletion during a privileged shred operation.
CVE-2026-116682 is a path traversal vulnerability in FileBrowser Quantum before versions 1.5.2-stable and 2.0.1-beta. The backend improperly resolves symbolic links without verifying that the target remains within the authorized scope. This allows authenticated users with download access, and even unauthenticated users with public share links, to read files outside their assigned directories. The issue is fixed in versions 1.5.2-stable and 2.0.1-beta.
A path traversal vulnerability (CWE-22) exists in the systeminformation Node.js library prior to version 5.33.14. The Linux networkStats(iface) function improperly uses a caller-supplied interface name to build filesystem paths without validating that the input is a single segment or that the resolved path remains within the expected directory. This allows a local attacker who can control the iface parameter and set up symlinked directories to read the first line of arbitrary files accessible to the Node.js process. The package does not expose a network endpoint, so exploitation requires local filesystem access and setup. The issue is fixed in version 5.33.14.
An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values.
CVE-2026-93864 is a path traversal vulnerability in WatchGuard Fireware OS's firewall daemon. It allows a local attacker with low-privileged code execution to overwrite arbitrary files with root privileges by planting a crafted file system object and triggering a list update. This can also lead to tampering with firewall IP set data. The vulnerability affects multiple versions of Fireware OS and has been assigned a high severity rating.
CVE-2026-76654 is a vulnerability in Kubernetes affecting Windows nodes where the kubelet resolves symbolic links in pod volume mounts that point to attacker-controlled network shares. This causes the kubelet to attempt NTLM authentication to the share, leaking the NetNTLMv2 hash of the kubelet's account. An attacker could use this hash to attempt password cracking or relay attacks to impersonate the node if it is domain-joined. The vulnerability affects multiple Kubernetes versions from 1.34.0 through 1.37.0.
zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9.0.0, ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir use safe_prepare_path in src/read/zipfile.rs and simplified_components in src/path.rs to validate symbolic link targets with a lexical prefix comparison rather than resolving each intermediate link. An attacker who knows or can guess the absolute extraction destination can create a chain whose apparent target remains under the destination while an intermediate symlink resolves outside it, allowing attacker-controlled files to be created or overwritten with the extracting process's privileges. On Windows, discarded drive and UNC prefixes can permit a single-link escape when the process has SeCreateSymbolicLinkPrivilege, such as through administrator rights or Developer Mode. This regression is distinct from CVE-2025-29787. This issue is fixed in version 9.0.0.
Fallow, a codebase intelligence tool for TypeScript and JavaScript, has a path traversal vulnerability in versions from 2.68.0 up to but not including 3.34.0. The tool follows attacker-controlled Jest and Vitest project paths outside the project root via absolute paths, parent directory segments, wildcard globs, or symlinks. This causes Fallow to parse external files as test-runner configuration, which can alter dependency and file usage analysis results. The vulnerability does not expose file contents externally. The issue is fixed in version 3.34.0.
Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-114462 is a link following vulnerability in Velneo vServer affecting versions from 36.0 up to but not including 36.6, and from 37.0 up to but not including 37.2. The flaw involves improper resolution of symbolic links before file access, which can lead to unintended file operations. This vulnerability has a medium severity with a CVSS score of 6.0. Fixed versions are 36.6 and 37.2.
CVE-2026-113724 is a vulnerability in pypa virtualenv prior to version 21.14.9. The issue involves the safe_delete() error handler following symbolic links when attempting to change permissions after a failed deletion. This behavior can cause a victim-owned target outside the intended directory to become writable by others if certain conditions are met. The vulnerability is fixed in version 21.14.9.
CVE-2026-113721 is a vulnerability in pypa virtualenv versions prior to 21.14.9. It involves improper handling of symbolic links during environment creation, allowing a local attacker with limited privileges to cause files outside the intended virtual environment directory to be created or overwritten. This occurs because the tool does not properly remove dangling symlinks and opens configuration files without replacing existing symbolic or hard links. The issue is fixed in version 21.14.9.
CVE-2026-113716 is a vulnerability in pypa virtualenv versions prior to 21.14.9 where the builtin environment creator accepts existing directory symlinks during directory preparation. This allows writes outside the intended environment directory through symlinked paths, potentially enabling an attacker with limited access to plant files or executables in locations like ~/.local/bin. The issue arises because ensure_dir() follows symlinks and writes environment files through them, bypassing intended directory boundaries. The vulnerability was fixed in version 21.14.9.
filelock is a platform-independent file lock for Python. From 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock versions from 3.20.4 resolve the lock path and pass it to SQLite without rejecting a final symbolic link, allowing another local user who can create names in the lock directory to redirect database creation and locking or split mutual exclusion between targets. This issue is fixed in version 4.0.9.