CWE-59: Link Following vulnerabilities

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".

PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of AIP files. By creating a symbolic link, an attacker can abuse the installer process to write arbitrary files. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-30583.

Etherpad-lite versions prior to 3.1.0 use Math.random() to generate temporary filenames for import/export operations in a shared temporary directory. This allows a local unprivileged attacker to predict these filenames and create symbolic links that cause the Etherpad process to overwrite arbitrary files with attacker-controlled content. The vulnerability is fixed in version 3.1.0.

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's put_file resolved a transfer's destination to a path on the jail host ( + ) and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the jail was followed by the host-side, root-privileged mv. A party controlling content inside a managed jail (the jail's root, or any process able to create a symlink in a directory an Ansible task later writes to) can therefore cause an arbitrary root-owned write on the host, outside the jail — a full jail escape. Arbitrary root-owned host writes are readily escalated to host compromise (e.g. cron, rc.d, authorized_keys). Preconditions for this vulnerability are that the operator runs a copy/template/fetch-style task (anything using put_file) against the jail, and the attacker can place a symlink inside the jail at or above the task's destination before the transfer runs. This issue has been fixed in version 2.0.0.

A path traversal vulnerability exists in rsync versions 2.3.3 through 3.4.4. This flaw allows a malicious sender to escape the intended module root directory by exploiting symbolic links when using the --partial-dir or --backup-dir options. An attacker with write access to place or leverage symlinks can cause arbitrary file writes outside the module root.

CVE-2026-53803 is a symlink following vulnerability in rsync versions up to 3.4.4 that allows local attackers to overwrite arbitrary files by exploiting predictable output paths such as --log-file or --write-batch. This flaw can lead to local privilege escalation on systems where rsync runs with elevated privileges, including setuid or privileged daemon configurations.

A symlink race condition vulnerability exists in rsync versions up to 3.4.4, allowing attackers who can manipulate symlinks in the sender's scanned directory tree to cause file enumeration and transfer outside the intended module root. This affects both daemon-mode and non-daemon sender-side scanning.

CVE-2026-53800 is a symlink race condition vulnerability in rsync versions up to 3.4.4 affecting the --remove-source-files feature. It allows an attacker who can create symbolic links to cause arbitrary file deletion by replacing a source file with a symlink between the file transfer and the removal step. This can result in unintended deletion of files pointed to by the symlink target instead of the intended source files.

A symlink race condition vulnerability exists in rsync versions up to 3.4.4 that allows local attackers to redirect the application of ACLs or extended attributes to unintended files by substituting a symlink during a timing window. This can lead to elevated permissions and local privilege escalation.

A path traversal vulnerability (CWE-59) exists in rsync versions up to 3.4.4. This flaw allows a malicious sender to write files outside the intended destination directory by exploiting symlink resolution in --relative mode. The vulnerability arises because the make_path() function follows symlinks without verifying that the resulting paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.

CVE-2026-53784 is a path traversal vulnerability in rsync versions up to 3.4.4. When the rsync daemon is configured with use chroot disabled and the module root or a component of it is a symbolic link, remote clients can access files outside the intended module root. This occurs because the daemon changes directory to the module root without resolving symlinks, causing relative path operations to reference unintended locations.

During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to execute code with elevated privileges.

During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges.

An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges.

A symlink race condition vulnerability exists in rsync versions up to 3.4.4. This flaw allows an attacker who can manipulate a parent directory of the source tree to redirect file reads to unintended paths by replacing a directory component with a symlink during traversal. This can lead to disclosure of file contents outside the intended transfer root.

A time-of-check to time-of-use (TOCTOU) race condition exists in rsync before version 3.5.0 in the non-daemon receiver's handling of the destination directory. This vulnerability allows an attacker who can manipulate the destination path's parent components to redirect file writes to unintended locations by substituting a symlink between path resolution and the directory change operation. This causes the working directory to be set outside the intended destination tree, potentially leading to unauthorized file writes.

CVE-2026-53795 is a high-severity vulnerability in rsync versions up to 3.4.4 that allows arbitrary file write outside the intended destination directory. This occurs due to improper link resolution when using the --temp-dir or --link-dest options, enabling attackers to bypass rename-confinement logic and write files to arbitrary locations accessible by the rsync process.

CVE-2026-53793 is a critical vulnerability in rsync versions up to 3.4.4 that allows remote clients to bypass path confinement. By exploiting improper handling of the /./ boundary marker in module roots, attackers can access files outside the intended directory subtree, potentially gaining unauthorized read or write access.

CVE-2026-53783 is a high-severity vulnerability in rsync versions up to 3.4.4. It involves a time-of-check to time-of-use (TOCTOU) race condition in the rrsync restricted shell wrapper, allowing authenticated clients to bypass directory restrictions by substituting symlinks after validation. Attackers can exploit certain unrestricted flags to read or write files outside the allowed directory subtree.

An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent. The Prisma Access Agent on macOS, Windows, iOS, Android, and Chrome OS is not affected.