A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a subsequent elevated Winlogbeat operation to write to or delete arbitrary files. Successful exploitation could result in a denial of service.
A vulnerability in the Backblaze Client allows a local user to make the system not bootable by creating a link from Backblaze's folder to Windows OS system files during a backup. Successful exploitation requires an administrator-level system change that results in the absence of specific Windows OS security controls. This vulnerability is due to improper link resolution.
CVE-2026-55569 is a path traversal vulnerability in the aqua command-line version manager prior to version 2.60.1. The vulnerability arises because the software does not verify that symbolic link targets remain within the intended extraction directory during archive unpacking. This allows a malicious archive to write files outside the extraction directory with the privileges of the user running aqua, potentially overwriting important files such as shell startup scripts or executable paths. The issue is fixed in version 2.60.1.
CVE-2026-59311 is a vulnerability in Spring Integration affecting certain versions where a local unprivileged user can exploit improper link resolution before file access. By pre-creating a symbolic link at /tmp/ziptransformer before the application starts, the user can redirect the output of Zip/UnZip transformers to a directory of their choosing. This affects specific versions of Spring Integration including 7.1.0, 7.0.0 to 7.0.5, 6.5.0 to 6.5.10, and 6.4.0 to 6.4.12. The vulnerability has a CVSS score of 6.8, indicating medium severity.
Dool versions up to 1.3.8 have a vulnerability related to improper symlink handling when the "--devel" flag is used. The application opens a log file without the O_NOFOLLOW flag, allowing a local attacker to create a symbolic link at the log file path that points to a sensitive file. This can cause dool to overwrite the target file with log data, which is particularly dangerous if dool runs with elevated privileges. The issue was fixed in a pull request #116.
CodeMeter Runtime versions 8.40 up to but not including 8.41a and 9.00 up to but not including 9.10 contain a vulnerability where the cmu.exe process creates a predictable temporary file under C:\CM-Stick without properly checking for NTFS reparse points such as junctions or symbolic links. This improper link resolution can allow a local attacker to create a junction pointing to an arbitrary system path, potentially causing deletion of arbitrary files with System privileges and enabling local privilege escalation.
CVE-2026-65647 is a high-severity vulnerability in WebPros Plesk Migrator involving improper symbolic link resolution before file access. This flaw allows remote authenticated users to execute arbitrary code with root privileges. The vulnerability is categorized under CWE-59, indicating a link following issue. No patch or official remediation has been confirmed yet. There are no known exploits in the wild at this time.
CVE-2026-61792 is a path traversal vulnerability in Weblate prior to version 2026.7. It allows a project administrator to read files outside their repository via the App store metadata download feature due to insufficient path restriction. This vulnerability is an incomplete fix of a previous issue (CVE-2026-34242) and permits disclosure of arbitrary files on the Weblate host. The issue is resolved in version 2026.7.
CVE-2026-66153 is a high-severity vulnerability in the SonicWall NetExtender Linux client. It involves improper handling of temporary files during the NEService auto-upgrade process, allowing an attacker to manipulate file paths due to insecure link resolution before file access. This can lead to unauthorized file access or modification. No patch or official remediation guidance is currently available from the vendor. The vulnerability requires local access with low privileges and has a high attack complexity. There are no known exploits in the wild at this time.
Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with `can_create_images` and `can_create_instances`) can execute arbitrary code as root on the host. A crafted image ships `backup.yaml` as a symlink to a host file. When the root daemon writes the instance's backup file, it follows the symlink. Version 7.3.0 patches the issue.
CVE-2026-17171 is a vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1, involving improper resolution of symbolic links before file access. This flaw allows a local attacker to overwrite arbitrary files by exploiting the improper link resolution behavior. The vulnerability has a high severity rating with a CVSS score of 7.8, indicating significant potential impact on confidentiality, integrity, and availability.
CVE-2026-16989 is a vulnerability in IBM AIX versions 7.2 and 7.3, and IBM PowerVM VIOS 4.1, involving improper resolution of symbolic links. This flaw could allow a local attacker to gain elevated privileges by exploiting how symbolic links are handled before file access. The vulnerability has a high severity rating with a CVSS score of 7.1, indicating significant confidentiality and integrity impact without availability impact.
CVE-2026-16980 is a vulnerability in IBM AIX 7.2, 7.3, and IBM PowerVM VIOS 4.1 involving improper validation of symbolic links. This flaw can allow a local attacker to cause a denial of service by exploiting improper link resolution before file access. The vulnerability has a CVSS 3.1 base score of 6.3, indicating a medium severity level. No public exploits are known, and no patch or remediation details are provided in the available data.
CVE-2026-18267 is a vulnerability in the Kenwood DNR1007XR device firmware update process. It allows an attacker with physical access to create a symbolic link that causes improper link resolution before file access. This flaw can be exploited to move files to arbitrary locations and execute arbitrary code with root privileges without requiring authentication.
Etherpad versions prior to 3.1.0 contain a vulnerability in the ImportHandler and ExportHandler modules where temporary filenames are derived from Math.random() and placed in a world-writable temporary directory. This allows a local unprivileged attacker who can predict the filename to create a symbolic link to a file writable by the Etherpad process. Subsequent import or export operations may follow this link and overwrite the target file with attacker-controlled content. The issue is fixed in version 3.1.0.
Dell Command Update (DCU) versions prior to 5.7.1 contain a vulnerability involving improper link resolution before file access. This flaw could allow a low privileged local attacker to potentially elevate their privileges on the affected system. The vulnerability is identified as CWE-59 and is classified with a medium severity rating.
CVE-2026-47187 is a critical vulnerability in sshfs, a network filesystem client for SSH servers, affecting versions prior to 3.7.6. A malicious SFTP server can supply symlink targets that cause sshfs to resolve links against the local filesystem improperly. This can lead to disclosure of local readable files or overwriting writable local files with server-controlled content, including sensitive startup or scheduled-task files. The issue is fixed in sshfs version 3.7.6.
CVE-2026-47699 is a path traversal vulnerability in Confidential Containers Guest Components versions 0.16.0 through 0.19.x. It allows a crafted OCI image layer to create a hardlink outside the intended directory during image unpacking, potentially enabling a workload owner to escape into the pod virtual machine and abuse its capabilities. The issue is fixed in version 0.20.0.
CVE-2026-17106 is a vulnerability in the tar extraction routines of moby/go-archive where filesystem operations are not confined to the intended destination directory. The extraction process relies on lexical string checks but performs OS-resolved filesystem operations, allowing symbolic links in archives to escape the target directory. An attacker controlling archive contents can create or overwrite arbitrary files writable by the extracting process.
A vulnerability in extract-zip versions 1.0.0 through 2.0.1 allows an attacker to write arbitrary files outside the intended extraction directory. This occurs because the software only checks the parent directory of each archive entry and not the final path component, enabling exploitation via symlink entries followed by regular files with the same name.