CWE-59: Link Following vulnerabilities

filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the conditional os.access writability check for a node without its owner-write bit, allowing another local user on a platform and directory configuration that follows the link to infer whether a chosen path exists and is writable from the observable acquisition result. This issue is fixed in version 4.2.1.

CVE-2026-111045 is a vulnerability in anshupriyan cli-bridge prior to version 0.0.2 where a dangling symlink outside the workspace root can bypass path resolution checks. This allows write_file operations to follow the symlink and write arbitrary files outside the intended workspace root. The issue is fixed in version 0.0.2.

CVE-2026-55480 is a vulnerability in OpenPrinting CUPS prior to version 2.4.20 where a race condition in the copy_model() function allows a privileged process to follow a symlink and overwrite arbitrary root-writable files. This occurs because a temporary file path is created in a group-writable directory without secure flags, enabling symlink attacks. Exploitation requires an attacker with lp-group write access and a privileged add-printer or modify-printer operation. The issue is fixed in version 2.4.20.

CVE-2026-53882 is a high-severity vulnerability in QNAP Systems Inc. Virtualization Station involving improper link resolution before file access (CWE-59). A remote attacker with a user account can exploit this flaw to compromise system security. The issue is fixed in Virtualization Station version 4.1.1.130 and later.

FileRise versions prior to 3.23.0 have a vulnerability where archive entries are extracted without fully validating resolved paths. This allows an authenticated non-administrator user with extract permission to overwrite or delete files outside the intended storage root if a symlink to an external directory exists in the destination. The issue is fixed in version 3.23.0.

FileRise versions prior to 3.15.0 contain a vulnerability where public shared-folder links with subfolder browsing enabled can follow symbolic links to access sibling directories outside the intended shared folder. This allows an unauthenticated user with a valid share token to list, download, or create ZIP archives of files outside the shared folder boundary. The issue arises because symlink resolution does not enforce the original shared folder as a boundary. The vulnerability is fixed in version 3.15.0.

CVE-2026-104103 is a path traversal vulnerability in ludwig-ai's ludwig framework prior to version 0.17.8. The flaw exists in the extract_archive() function, which improperly validates symlink and hard-link members in tar archives, allowing crafted archives to write files outside the intended extraction directory. This can lead to attacker-controlled content being placed at arbitrary filesystem paths with the privileges of the extracting process. The issue affects Python 3.12 and 3.13 runtimes but not Python 3.14, which rejects such escaping links by default. The vulnerability is fixed in version 0.17.8.

CVE-2026-108135 is a vulnerability in the Windows Backup Engine of Microsoft Windows 10 Version 21H2 that involves improper link resolution before file access, known as 'link following'. This flaw allows an authorized local attacker to elevate privileges. The issue affects multiple builds of Windows 10 Version 21H2 prior to specific fixed versions. Microsoft has released official fixes for all affected versions.

CVE-2026-102204 is a high-severity vulnerability in Microsoft Windows Subsystem for Linux (WSL2) involving improper link resolution before file access. This flaw allows an authorized local attacker to elevate privileges by exploiting the link following behavior. The vulnerability affects WSL2 versions from 5.0.0.0 up to but not including 3.0.1. Microsoft has issued an official fix in version 3.0.1 to address this issue.

CVE-2026-102202 is a high-severity vulnerability in Microsoft Windows 11 version 23H2 involving improper access control in the Windows Container Isolation FS Filter Driver (unionfs.sys). This flaw allows an authorized local attacker to elevate privileges. The vulnerability affects multiple builds of Windows 11 23H2 prior to their respective fixed versions. An official fix is available from Microsoft.

CVE-2026-97790 is a medium severity vulnerability in Microsoft Windows 11 Version 24H2 involving improper link resolution before file access in the Windows Container Isolation FS Filter Driver (unionfs.sys). This flaw allows an authorized local attacker to perform tampering by exploiting link following behavior. The issue affects multiple Windows 11 builds prior to specific fixed versions. An official fix is available from Microsoft.

CVE-2026-96911 is a vulnerability in the Microsoft Windows Search Component affecting Windows 10 Version 1607 and other specified versions. It involves improper link resolution before file access, known as 'link following,' which allows an authorized local attacker to elevate privileges. The vulnerability has a high severity with a CVSS score of 7.8. Microsoft has released official fixes for all affected versions.

CVE-2026-96243 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related builds involving improper link resolution before file access in the WalletService component. This flaw allows an authorized local attacker to elevate privileges by exploiting the link following weakness. The issue affects multiple Windows 10 versions prior to their respective fixed releases. Microsoft has issued official fixes for all affected versions.

CVE-2026-96225 is a high-severity vulnerability in the Microsoft .NET 10.0 runtime involving improper link resolution before file access, known as 'link following'. This flaw allows an authorized local attacker to elevate privileges. The issue affects multiple .NET runtime versions prior to fixed releases. Official patches are available from Microsoft to address this vulnerability.

CVE-2026-96231 is a high-severity vulnerability in Microsoft .NET 10.0 runtime involving improper link resolution before file access, known as 'link following'. This flaw allows an authorized local attacker to elevate privileges. The issue affects multiple .NET runtime versions prior to their respective fixed releases. Official patches are available and have been released for all affected versions.

CVE-2026-70264 is a vulnerability in Microsoft Windows Defender involving improper link resolution before file access, known as 'link following'. This flaw allows an authorized attacker with local access to disclose information. The vulnerability has a medium severity with a CVSS score of 5.5. Microsoft has released an official fix in version 1.1.26090.9 to address this issue.

CVE-2026-88191 is a local privilege escalation vulnerability in the Microsoft Windows Search Component affecting Windows 10 Version 1607 and related builds. The flaw involves improper link resolution before file access, known as 'link following,' which allows an authorized attacker to elevate privileges on the affected system. Microsoft has released official fixes for all affected versions.

CVE-2026-88133 is a high-severity vulnerability in the Windows Portable Device Enumerator Service affecting multiple versions of Microsoft Windows 10, including Version 1607. It involves improper authorization that allows an authorized local attacker to elevate privileges. The vulnerability has been officially fixed in several Windows 10 builds.

CVE-2026-88072 is a high-severity vulnerability in Microsoft Windows 10 Version 1809 and related builds. It involves improper access control in the Windows Host Guardian Service, allowing an authorized local attacker to elevate privileges. The flaw affects multiple Windows 10 versions prior to specific fixed releases. An official fix is available from Microsoft.

CVE-2026-83933 is a vulnerability in Microsoft Windows 10 Version 21H2 involving improper link resolution before file access in the Windows Update Orchestrator Service. This flaw allows an authorized attacker to locally disclose information by exploiting link following behavior. The issue affects multiple Windows 10 builds prior to their respective fixed versions. Microsoft has released official fixes for all affected versions.