CVE-2026-5223 is a medium severity vulnerability in Rust's Cargo tool where symlinks inside crate tarballs from third-party registries are incorrectly handled. This flaw allows a malicious crate to override the source code of another crate from the same registry. Users of the official crates.io registry are not affected because it forbids uploading crates containing symlinks.
A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.
CVE-2026-42275 is a high-severity vulnerability in openziti zrok prior to version 2.0.2. The zrok WebDAV drive backend improperly handles symbolic links, allowing remote WebDAV clients to access files outside the intended shared directory. This occurs because while path traversal is restricted via lexical normalization, symlink following is not prevented. As a result, attackers can read and potentially write or overwrite files anywhere accessible to the zrok process if OS-level permissions are not restrictive. The issue has been addressed in version 2.0.2.
Tunnelblick versions 3.3beta26 through 9.0beta01 contain a symbolic link (symlink) following vulnerability in the tunnelblick-helper component. This vulnerability allows any local user to read arbitrary root-owned files by exploiting the world-accessible tunnelblickd Unix socket, which lacks authorization checks. The issue is fixed in version 9.0beta02.
OpenClaw versions 2026.3.22 before 2026.4.5 have a symbolic link traversal vulnerability in the handling of remote marketplace repository paths. This flaw allows attackers to use crafted symlink paths to escape the intended repository root directory and access files outside the expected repository location.
A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target even when the --no-dereference (or -n) flag is explicitly provided. The implementation previously only honored the "no-dereference" intent if the --force (overwrite) mode was also enabled. This flaw causes ln to follow a symbolic link that points to a directory and create new links inside that target directory instead of treating the symbolic link itself as the destination. In environments where a privileged user or system script uses ln -n to update a symlink, a local attacker could manipulate existing symbolic links to redirect file creation into sensitive directories, potentially leading to unauthorized file creation or system misconfiguration.
Claude Code versions prior to 2.1.64 contain a path traversal vulnerability in their sandbox implementation. The sandbox did not prevent sandboxed processes from creating symbolic links pointing outside the workspace. When the unsandboxed process wrote to a path through such a symlink, it could write outside the intended sandbox without user confirmation. This combination allows sandbox escape and potential code execution outside the sandbox. Exploitation requires injecting untrusted content to trigger sandboxed code execution. Users with standard auto-updates have received the fix; manual update to version 2.1.64 or later is advised.
python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.
Flatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlink attack on g_file_trash.
A UNIX Symbolic Link (Symlink) Following vulnerability in the CLI of Juniper Networks Junos OS allows a local, authenticated attacker with low privileges to escalate their privileges to root which will lead to a complete compromise of the system.
When after a user has performed a specific 'file link ...' CLI operation, another user commits (unrelated configuration changes), the first user can login as root.
This issue affects Junos OS:
* all versions before 23.2R2-S7,
* 23.4 versions before 23.4R2-S6,
* 24.2 versions before 24.2R2-S3,
* 24.4 versions before 24.4R2-S2,
* 25.2 versions before 25.2R2.
This issue does not affect versions 25.4R1 or later.
CVE-2026-39860 is a critical vulnerability in the Nix package manager affecting Linux sandboxed builds. It arises from a flaw in the fix for a previous vulnerability (CVE-2024-27297) that allows arbitrary file overwrites by following symbolic links during fixed-output derivation output registration. This can be exploited by users who can submit builds to the Nix daemon, potentially leading to root privilege escalation by overwriting sensitive files. The issue does not affect sandboxed macOS builds. Multiple versions of Nix prior to specific fixed releases are vulnerable. The vulnerability has a CVSS score of 9. A fix is available in Nix versions 2.28.6, 2.29.
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, for {% include %}, {% render %}, and {% layout %}, LiquidJS checks whether the candidate path is inside the configured partials or layouts roots before reading it. That check is path-based, not realpath-based. Because of that, a file like partials/link.liquid passes the directory containment check as long as its pathname is under the allowed root. If link.liquid is actually a symlink to a file outside the allowed root, the filesystem follows the symlink when the file is opened and LiquidJS renders the external target. So the restriction is applied to the path string that was requested, not to the file that is actually read. This matters in environments where an attacker can place templates or otherwise influence files under a trusted template root, including uploaded themes, extracted archives, mounted content, or repository-controlled template trees. This vulnerability is fixed in 10.25.3.
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.
Dell AppSync, version(s) 4.6.0, contain(s) an UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.
CVE-2026-33711 is a medium severity vulnerability in Incus, a system container and VM manager, affecting versions prior to 6.23.0. The vulnerability arises from the use of predictable temporary file paths under /tmp for VM screenshots, allowing a local attacker to create symlinks that can be abused. On most Linux systems, a kernel security feature called protected_symlinks prevents exploitation, resulting in a permission denied error. However, on systems where this feature is disabled, an attacker can cause Incus to truncate and modify arbitrary files, potentially leading to denial of service or local privilege escalation. The issue is fixed in version 6.23.0.
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Because fs::metadata() follows symbolic links, a crafted tarball containing a symlink entry followed by a directory entry with the same name causes the crate to treat the symlink target as a valid existing directory — and subsequently apply chmod to it. This allows an attacker to modify the permissions of arbitrary directories outside the extraction root. This issue has been fixed in version 0.4.45.
Zed, a code editor, has an extension installer allows tar/gzip downloads. Prior to version 0.224.4, the tar extractor (`async_tar::Archive::unpack`) creates symlinks from the archive without validation, and the path guard (`writeable_path_from_extension`) only performs lexical prefix checks without resolving symlinks. An attacker can ship a tar that first creates a symlink inside the extension workdir pointing outside (e.g., `escape -> /`), then writes files through the symlink, causing writes to arbitrary host paths. This escapes the extension sandbox and enables code execution. Version 0.224.4 patches the issue.
Claude Code is an agentic coding tool. Prior to version 2.1.7, Claude Code failed to strictly enforce deny rules configured in settings.json when accessing files through symbolic links. If a user explicitly denied Claude Code access to a file (such as /etc/passwd) and Claude Code had access to a symbolic link pointing to that file, it was possible for Claude Code to read the restricted file through the symlink without triggering deny rule enforcement. This issue has been patched in version 2.1.7.
CVE-2026-1386 is a symbolic link following vulnerability in the jailer component of AWS Firecracker versions 1.13.1 and earlier, and 1.14.0 on Linux. It allows a local user with write access to the jailer directories to overwrite arbitrary host files via a symlink attack during jailer startup if the jailer runs with root privileges. The issue is fixed in Firecracker version 1.13.2 and 1.14.1 or later.
CVE-2026-23986 is a medium-severity vulnerability in copier versions prior to 9.11.2 that allows a malicious project template to overwrite arbitrary files outside the intended destination directory by exploiting symbolic link following combined with the _preserve_symlinks: true setting. This occurs without requiring privileges or authentication but does require user interaction to generate a project from a crafted template. The vulnerability enables attackers to cause data corruption or disruption by overwriting files according to the user's write permissions. The issue is patched in version 9.11.2. European organizations using copier for project templating should update promptly to mitigate risk. The vulnerability primarily affects UNIX-like systems where symbolic links are supported and copier is used.