pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.check_access_permission() and then opened the file for writing with a plain open() call. CVE-2026-7819 had previously hardened the separate file upload path by opening its target with O_NOFOLLOW, so that the kernel refuses to follow a symbolic link at the final path component, but save_file was left on an unprotected open(). A symbolic link already present when the check ran was rejected by the check itself; the remaining exposure was a link substituted at the final path component in the interval between the check and the write, at which point the write followed the link and landed outside the user's storage directory, creating or overwriting an arbitrary file as the operating-system account running pgAdmin.
Exploitation requires the ability to create or replace a symbolic link inside the requesting user's storage directory. pgAdmin exposes no interface that creates symbolic links, so this requires filesystem access to the pgAdmin host or to a shared or network-mounted storage backend, together with winning the timing window. The reporter did not achieve a write against a released version, having attempted approximately 63,000 racing requests without success; the reported defect is the uncovered write path rather than a demonstrated sandbox escape.
The fix routes save_file's write through the same O_NOFOLLOW-protected helper already used by the upload path, so both File Manager write sinks carry identical kernel-enforced protection, and reports a symbolic-link refusal explicitly instead of surfacing the underlying system error text. Note that files created by save_file are now given mode 0600, inheriting the behaviour introduced for uploads. The protection covers the final path component; substitution of an intermediate directory component is not addressed by this change.
This issue affects pgAdmin 4: from the introduction of the containment check in the File Manager save path before 9.18.
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets lexically, resolveRelToBase skips its parent-symlink walk for root-level entries, and writeFile follows a terminal symlink when opening a regular file. A malicious archive can therefore create a symlink chain whose lexical target remains inside the extraction root but whose resolved target is an attacker-selected absolute path, then overwrite that target with a same-named regular-file entry even when AllowPathTraversalOnWrite is false. Pulling an attacker-controlled artifact can create or overwrite any file writable by the process and may lead to code execution. This issue is fixed in version 2.6.2.
Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
CVE-2026-68491 is a critical vulnerability in Webpros SolusVM where improper link resolution before file access allows an attacker with limited privileges to overwrite arbitrary files via symbolic links. This flaw affects SolusVM versions from 0 up to but not including 1.30.15. The vulnerability has a high CVSS 4.0 score of 9.4, indicating severe impact potential. No official patch or remediation details are provided in the input data.
qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does not account for on-disk symlinks created earlier in the extraction process. A crafted tar archive can use a symlink chain to write or overwrite files one directory level above the intended extraction path. When qbee-agent performs the extraction with root privileges, this permits a root-privileged file write outside the intended destination. This issue is fixed in version 1.26.25.
On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user, potentially achieving host code execution.
CVE-2026-82049 is a high-severity vulnerability in the tarfile module of CPython 3.13 and earlier. Crafted tar archives containing a hard link to a symbolic link can cause extraction to modify file permissions or modification times outside the intended destination directory, or expose the contents of files outside the extraction tree. This affects multiple CPython versions prior to specific patch releases.
CVE-2026-87910 is a medium severity vulnerability in the Python Software Foundation's CPython implementation related to the tarfile module. When extracting links on systems that do not support links, the filter function is called twice but the return value of one call is ignored, potentially allowing unintended extraction behavior. This issue affects multiple CPython versions prior to specific fixed releases.
A vulnerability in crun versions 1.29.1 and earlier allows reopening /dev/null for stdio after pivot_root to follow a symlink, potentially attaching a host file to container stdio and changing its ownership. Default configurations that mount a fresh /dev are not affected. No fixed release was initially available, but Red Hat has released an update in crun 1.30-1.hum1 addressing this issue.
CVE-2026-69425 is a medium severity vulnerability in Microsoft Windows 11 version 23H2 involving improper link resolution before file access (link following) in the NTFS file system. This flaw allows an authorized local attacker to tamper with files by exploiting the way symbolic links are resolved. The issue affects multiple builds of Windows 11 23H2 prior to specific fixed versions. Microsoft has released official fixes for the affected versions.
CVE-2026-69289 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and related builds that involves improper link resolution before file access in Windows Setup Files Cleanup. This flaw allows an authorized local attacker to elevate privileges by exploiting link following behavior. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.
CVE-2026-83999 is a local privilege escalation vulnerability in the Windows Resilient File System (ReFS) Deduplication Service on Windows 11 Version 24H2. It involves improper link resolution before file access ('link following'), which allows an authorized attacker to elevate privileges locally. The vulnerability affects specific builds of Windows 11 Version 24H2 prior to certain fixed versions. A patch is available from Microsoft.
CVE-2026-70563 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 involving improper link resolution before file access in the Windows Shell. This flaw allows an unauthorized attacker to perform spoofing attacks over a network by exploiting the link following behavior. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. An official fix is available from Microsoft.
CVE-2026-69771 is a vulnerability in the Windows Container Manager Service of Microsoft Windows 11 version 23H2. It involves improper link resolution before file access, known as 'link following,' which allows an authorized local attacker to bypass a security feature. The issue affects multiple builds of Windows 11 23H2 prior to specific fixed versions. The vulnerability has a medium severity rating with a CVSS score of 4.7. An official fix is available and has been released in the specified fixed versions.
CVE-2026-69379 is a local privilege escalation vulnerability in Microsoft Windows 11 version 23H2. It involves improper link resolution before file access in the NTFS file system, allowing an authorized attacker to elevate privileges. The issue affects multiple builds of Windows 11 23H2 prior to specific fixed versions. Microsoft has released official fixes for the affected versions.
CVE-2026-68830 is a vulnerability in Microsoft Windows 10 Version 1607 and related builds involving improper link resolution before file access in the Windows Universal Plug and Play (UPnP) Device Host. This flaw allows an authorized attacker with local access to disclose information by exploiting link following behavior. The issue affects multiple Windows 10 builds prior to specific fixed versions. A patch is available from Microsoft to address this vulnerability.
CVE-2026-67368 is a high-severity vulnerability in Microsoft SQL Server 2017 (CU 31) involving improper link resolution before file access, known as 'link following'. This flaw allows an authorized attacker to elevate privileges over a network. The vulnerability affects multiple versions of SQL Server 2017, 2019, 2022, and 2024 builds prior to specific fixed releases. An official fix is available from Microsoft.
CVE-2026-78409 is a vulnerability in util-linux versions 2.42 through 2.42.2 affecting the X-mount.subdir option on Linux kernel 6.15 and later. The issue arises because the AT_SYMLINK_NOFOLLOW flag used in open_tree() does not prevent intermediate symlink traversal, allowing a local unprivileged user with an fstab-authorized X-mount.subdir entry to attach a host path at the intended mountpoint. This can lead to unauthorized file system access and modification.