CVE-2026-124584

wummel patool Gzip Extraction fileutil.py extract_gzip symlink

A vulnerability has been found in wummel patool 4.1.0. This vulnerability affects the function extract_gzip of the file patoolib/fileutil.py of the component Gzip Extraction Handler. The manipulation leads to symlink following. Local access is required to approach this attack. The researcher claims to have submitted a GHSA on the repository of the project.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wummel

Products

Patool

CVE-2026-6064

Norton, Avast, and AVG local privilege escalation via link following in Data Shredder

Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a privileged shred operation, enabling arbitrary file/folder deletion that is leveraged to gain NT AUTHORITY\SYSTEM privelages.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Gen Digital

Products

Avast Antivirus Avg Internet Security Norton Antivirus

CVE-2026-123532

gix-fs before 0.24.1 NTLM Credential Disclosure via Windows Symlink UNC Probe

gix-fs in gitoxide before 0.24.1 contains a credential disclosure vulnerability that allows remote attackers to capture NTLM credentials by supplying UNC symlink targets in a crafted repository. When a victim checks out the repository on Windows with symlinks enabled, gix_fs::symlink::create calls is_dir() on the UNC target, triggering SMB authentication that leaks the username, domain, and NTLMv2 hash.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Gitoxidelabs

Products

Gitoxide

CVE-2026-123496

Vikunja veans before 2.7.1 Symlink Following in veans init

Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to overwrite user files like ~/.bashrc or install veans hooks and plugins globally.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Vikunja

Products

Vikunja

CVE-2026-76496

Cisco Expressway Series Software Hardening Release: October 2026 - Improper Link Resolution Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp; The vulnerabilities tracked by CVE-2026-76496 are related to issues concerning improper link resolutions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-59.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Expressway Series

CVE-2026-64672

Terragrunt catalog predictable temp symlink clobber

Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink already placed at that path. A local attacker who can write to the temporary directory and predict the cataloged repository can redirect cleanup and cloning outside the intended root, causing an existing repository-named directory to be deleted and replaced in the victim's security context. The attack requires the victim to run terragrunt catalog on a shared host while the symlink is present, and it is not remotely exploitable. This issue is fixed in version 1.1.1.

CVSS 4.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Gruntwork-io

Products

Terragrunt

CVE-2026-121549

nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins

nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write.

CVSS 4.0 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Jarun

Products

Nnn

CVE-2026-96284

Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following

A malicious user can get read-access to files in the flatpak-system-helper context if a system OCI repository is configured, because the OCI code paths in the system helper follow symlinks when importing OCI images that are under the user's control.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Flatpak Redhat

Products

Flatpak Enterprise Linux Rhel Els

CVE-2026-96282

Flatpak: flatpak: extension metadata path traversal file existence oracle

A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory listings can be disclosed to sandboxed applications using the extension. Additionally, unvalidated extension metadata can cause extension content to be mounted at unintended locations inside the sandbox.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Flatpak Redhat

Products

Flatpak Enterprise Linux Rhel Els

CVE-2026-123037

Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)

A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Acm Ansible Automation Platform Ansible Core and 9 more

CVE-2026-103401

Session Smart Router and Session Smart Conductor: An attacker can overwrite arbitrary files as root

An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints. This vulnerability can be exploited on Mist-managed routers and on unmanaged Routers that have not yet been onboarded to a Conductor. Routers already managed by Conductor are not affected.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Juniper

Products

Session Smart Conductor Session Smart Router

CVE-2026-118990

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup

CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob() has the sqlite3 shell write the dump to /tmp/cbdump<pid> and never removes it. The file takes the process umask, and a symlink planted at that predictable name is followed. The dump holds every user's password hash and every value saved by the application's forms. A local user can read these after any backup, and may redirect the dump to a file of their choosing.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Perl

Products

Callbackery

CVE-2026-111802

Nautilus: nautilus: arbitrary file deletion via trash symlink

A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the prompt to empty the trash, leading to the arbitrary deletion of files accessible to that user.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Rhel Els

CVE-2026-64212

wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it In iwl_mld_remove_link, the link->fw_id is saved at the beginning of the function so we have it after we freed the link. But the link pointer can be NULL, and is not checked when the fw_id is stored. Fix it by simply freeing the link at the end of the function. fFixes: 0e66a39f4f0e ("wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link()")

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2026-87008

Code Graph RAG structural tools follow out-of-root symlinks

Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebase_rag/tools/ast_grep_service.py enumerates files beneath project_root and relies on should_skip_path in codebase_rag/utils/path_utils.py to classify them, but the containment check operates on unresolved lexical paths. A symbolic link planted inside an analyzed repository can therefore reference a file outside the configured root while still appearing in scope. The structural_search tool follows the link and discloses readable content without an approval gate, while structural_replace with dry_run=False follows it and overwrites writable content; the MCP path invokes structural replacement without the agent-loop approval control. An attacker who causes a victim to analyze a repository containing such a link can read credentials, keys, environment files, or sibling source and can modify files accessible to the code-graph-rag process. This issue is fixed in version 0.0.589.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Vitali87

Products

Code-graph-rag

CVE-2026-112110

Privileged file deletion in SafeNet Authentication Client SACSrv

A time-of-check to time-of-use race condition in the SafeNet Authentication Client (SAC) SACSrv log-cleanup function can allow an authenticated, non-administrator local user to redirect a privileged file deletion operation outside the intended log directory.  This issue affects SAC releases up to and including 10.9 R3 GA (build 10.9.7449).

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Thalesgroup

Products

Safenet Authentication Client Service Safenet Authentication Service

CVE-2024-5742

Nano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file

A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Nano Enterprise Linux Rhel Els

CVE-2026-118599

epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install

A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany's archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi. This is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143). Requirements: the victim must install or open a malicious WebExtension (.xpi). Affected: Epiphany >= 47.0 (WebExtension XPI install path). Fixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 — only enable ZIP format support). Upstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988 Reporter acknowledgment: Fernando Munoz

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gnome

Products

Epiphany

CVE-2026-119083

GluonTS arbitrary file write during archive extraction

Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or hard links contained in the archive. To remediate this issue, users should upgrade to version 0.17.0 or later.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Aws

Products

Gluonts

CVE-2023-7216

Cpio: extraction allows symlinks which enables remote command execution

A path traversal vulnerability was found in the CPIO utility. This issue could allow a remote unauthenticated attacker to trick a user into opening a specially crafted archive. During the extraction process, the archiver could follow symlinks outside of the intended directory, which allows files to be written in arbitrary directories through symlinks.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Cpio Enterprise Linux Rhel Els