CVE-2026-100395 is a vulnerability in LXC version 7.0.0 and earlier where the lxc-copy tool and the liblxc clone() API can follow attacker-controlled symbolic links when updating /etc/hostname in a copied container root filesystem. This can lead to a privileged process overwriting files outside the intended container root filesystem if the source rootfs is attacker-controlled or less trusted. The issue arises because the clone operation preserves symlinks before updating the hostname, allowing a symlink to point outside the destination rootfs. Unprivileged users and independent cloning implementations are not affected. Using the LXC_CLONE_KEEPNAME flag avoids the hostname update and mitigates the issue.
borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. Prior to 1.4.5 and 2.0.0b22, extracting a malicious archive can follow a symlinked parent path or resolve embedded dot-dot path components and delete or overwrite files outside the extraction directory. A crafted slave hardlink can also use an attacker-controlled hardlink source outside the extraction directory and hard-link that file into the restored tree, disclosing its contents. Creating the malicious archive requires repository access and, for encrypted or authenticated repositories, the Borg key and passphrase; a victim must then extract the archive. This issue is fixed in versions 1.4.5 and 2.0.0b22.
Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebase_rag/tools/ast_grep_service.py enumerates files beneath project_root and relies on should_skip_path in codebase_rag/utils/path_utils.py to classify them, but the containment check operates on unresolved lexical paths. A symbolic link planted inside an analyzed repository can therefore reference a file outside the configured root while still appearing in scope. The structural_search tool follows the link and discloses readable content without an approval gate, while structural_replace with dry_run=False follows it and overwrites writable content; the MCP path invokes structural replacement without the agent-loop approval control. An attacker who causes a victim to analyze a repository containing such a link can read credentials, keys, environment files, or sibling source and can modify files accessible to the code-graph-rag process. This issue is fixed in version 0.0.589.
A time-of-check to time-of-use race condition in the SafeNet Authentication Client (SAC) SACSrv log-cleanup function can allow an authenticated, non-administrator local user to redirect a privileged file deletion operation outside the intended log
directory.
This issue affects SAC releases up to and including 10.9 R3 GA (build 10.9.7449).
Node Version Manager (nvm) versions 0.40.0 through 0.40.8 contain a vulnerability where the commands 'nvm use --save' and 'nvm install --save' write the resolved Node.js version string to a .nvmrc file in the current directory using 'tee', which follows symbolic links. If the .nvmrc file is a symlink to a file outside the repository, this can cause unintended truncation and overwriting of arbitrary writable files, such as shell startup files or SSH authorized_keys, resulting in data loss. Version 0.41.0 fixes this by refusing to write to .nvmrc if it is a symlink, issuing a warning instead.
Node Version Manager (nvm) versions 0.2.0 through 0.40.8 do not properly check if the .nvmrc file is a symbolic link. This allows an attacker to craft a symlinked .nvmrc pointing to arbitrary files, causing nvm commands to read and print the contents of those files in command output or logs. Version 0.41.0 fixes this by not printing the contents of symlinked .nvmrc files and only accepting valid version strings or aliases.
CVE-2026-64672 is a vulnerability in terragrunt versions prior to 1.1.1 where the catalog command follows a symlink in a predictable temporary directory. A local attacker with write access to the temporary directory can redirect operations to delete and replace directories outside the intended root, but exploitation requires local access and user interaction. This issue is fixed in version 1.1.1.
CVE-2026-88968 is a high-severity vulnerability in anthropics claude-code versions prior to 2.1.251. The Edit tool improperly validates target paths and symlinks without binding to the underlying directory inode or file descriptor. On macOS, this allows attacker-controlled code running inside the Bash sandbox to replace a parent directory with a symlink after validation, leading to the Edit tool overwriting files outside the intended workspace. Exploitation requires code execution within the sandbox, such as from malicious repositories or dependency scripts. The issue is fixed in version 2.1.251.
A path traversal vulnerability (CWE-22) exists in isomorphic-git versions prior to 1.38.6. The issue occurs during git.checkout operations where symlinked leading directory components are not properly checked, allowing writes outside the intended working tree on Linux or macOS. This can lead to arbitrary file writes and potential code execution on the host. The vulnerability is fixed in version 1.38.6.
Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with the invoking user's permissions.
MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for get_regex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file containing unauthorized user-controlled data outside that directory, using the operator process's filesystem permissions. The issue can occur with default traversal and overwrite settings. Exploitation requires an operator to retrieve matching files from the affected working directory; the demonstrated default behavior creates a new file rather than overwriting an existing file. This issue affects MongoDB Database Tools versions 100.2.0 through versions before 100.20.1.
On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read query text and data from another user's logs, and can place a symbolic link at the predictable path so that the driver appends log data to a file of the attacker's choosing with the victim's privileges. Versions before psqlODBC 18.00.0006 are affected.
The Beta9 worker serves the sandbox file API from outside the container. getHostPathFromContainerPath turns the tenant's container path into a worker path. If the unresolved path starts with a mount destination, including the default upload mount at /tmp/.beta9, the remainder is joined onto that mount's source with filepath.Join, which cleans parent-directory segments after the prefix check. A long enough run of those segments names any absolute path on the worker. A path that matches no mount is joined onto the container root and opened in the worker's own filesystem, so an absolute symbolic link such as /var/run pointing at /run is followed against the worker root. Upload, download, stat, list, find-in-files, replace-in-files, and delete-file all call this helper. A tenant with a workspace token and one running sandbox can read, write, list, and delete files on the hosting worker as root, including files of other tenants on that machine. A read-only proof downloaded the worker pod's Kubernetes service account token through the file API for a path that did not exist inside the sandbox. In the shipped remote-node manifests that service account is bound to cluster-admin. Fixed in worker 0.1.756: sandbox file operations and workspace sync open paths with os.OpenRoot, so parent-directory and symlink lookups stay inside the container root or the mount source.
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker executing as pihole can replace that path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive target world-readable without truncating it. This issue is fixed in version 6.5.
Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a different file. A pihole-readable decoy can therefore pass the check while curl reads a root-only target, and /proc/self paths can similarly resolve against different processes. Exploitation requires an administrator who can add adlists and can place a symlink and decoy on the filesystem. This issue is fixed in version 6.5.
CVE-2026-116250 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in pgAdmin 4 server mode prior to version 9.19. It allows an attacker with write access to the user's storage directory to exploit symbolic or hard links or FIFOs to read, write, or load files outside the intended storage directory with the privileges of the pgAdmin operating system account. Exploitation requires the ability to create such links or FIFOs in the storage directory and to win a race condition. The issue was fixed in pgAdmin 4 version 9.19 by securely opening files component-by-component with O_NOFOLLOW and passing open file descriptors to utilities.
Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker who supplies an untrusted cloned repository, template, or archive with a symbolic link at a scaffolded name can cause setup to overwrite a target outside the selected directory with the invoking user's permissions. The .gitignore path requires no flag, while --force permits a linked launcher target to be written and made executable; import can also read link-target content and incorporate it into the generated build file. This issue is fixed in version 1.4.0.
CallBackery versions prior to 0.62.0 for Perl create a temporary configuration database dump in /tmp with insecure permissions. The dump file is world-readable and not removed after creation, exposing sensitive data including password hashes. A local user can exploit this by reading the dump or redirecting it via a symlink to a file of their choosing.
HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.