Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2026-0291
Medium · 4.4
CWE-59 Aug 13, 2026
Prisma Access Agent: Authenticated Limited File Deletion on Linux
An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent.
The Prisma Access Agent on macOS, Windows, iOS, Android, and Chrome OS is not affected.
CVE-2026-63294
Critical · 9.9
CWE-59 Aug 12, 2026
Root RCE via image backup.yaml symlink
A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as a symbolic link. An attacker can exploit this flaw by providing a malicious archive with a symlinked backup.yaml file, causing LXD to process unconfined configuration metadata and execute arbitrary commands with root privileges.
CVE-2026-63293
Critical · 9.9
CWE-59 Aug 12, 2026
Arbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as root
A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a crafted image archive with a symlinked metadata.yaml file pointing to target file paths on the host system.
CVE-2026-65680
Medium · 6.7
CWE-59 Aug 11, 2026
Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized attacker to elevate privileges locally.
CVE-2026-72971
Medium · 5.5
CWE-59 Aug 11, 2026
Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability
Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally.
CVE-2026-70348
Medium · 5.5
CWE-59 Aug 11, 2026
Windows Management Services Denial of Service Vulnerability
Improper link resolution before file access ('link following') in Windows Management Services allows an authorized attacker to deny service locally.
CVE-2026-62832
High · 7.8
CWE-59 Aug 11, 2026
Windows User Profile Service Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.
CVE-2026-62812
High · 7.8
CWE-59 Aug 11, 2026
Windows DHCP Server Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.
CVE-2026-62807
High · 7.8
CWE-59 Aug 11, 2026
Windows DHCP Server Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.
CVE-2026-62803
High · 7.8
CWE-59 Aug 11, 2026
Windows DHCP Server Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.
CVE-2026-62776
High · 7.8
CWE-59 Aug 11, 2026
Windows DHCP Server Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.
CVE-2026-62761
High · 7.8
CWE-59 Aug 11, 2026
Windows DHCP Server Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows DHCP Server allows an authorized attacker to elevate privileges locally.
CVE-2026-61358
High · 7.8
CWE-59 Aug 11, 2026
Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to elevate privileges locally.
CVE-2026-72694
High · 7.1
CWE-59 Aug 11, 2026
Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation
A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive files.
CVE-2025-30240
Medium · 5.1
CWE-59 Aug 10, 2026
Arbitrary File Read via Improper Symlink Handling in USB HTTPS Access Path in multiple TP-Link Aginet Devices
The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage
devices. By placing a crafted symbolic link on supported storage media, an
attacker may cause the system to resolve the link.
Successful
exploitation may allow unauthorized read access to sensitive files within the
device filesystem.
CVE-2026-63622
High · 7.8
CWE-59 Aug 10, 2026
Libvirt: swtpm privilege escalation via symlink following
A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control.
CVE-2026-71964
Medium · 6.5
CWE-59 Aug 10, 2026
CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload
CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure to validate symlinks before extraction, causing symbolic links targeting arbitrary filesystem paths outside the user's home directory to persist on disk and be accessed through the web interface.
CVE-2026-70622
Medium · 6.5
CWE-59 Aug 10, 2026
tar-rs 0.4.11 - 0.4.46 Symlink Escape via append_dir_all()
tar-rs versions 0.4.11 through 0.4.46 contain a symlink escape vulnerability in the Builder::append_dir_all() function that allows attackers to read files outside the intended source root directory by planting symlinks in an attacker-controlled directory. When a privileged process archives an untrusted directory, the function follows symlinks without verifying that resolved targets remain within the source root, causing out-of-bounds files to be included in the archive as regular files and disclosed to the attacker.
CVE-2026-17435
Low · 2.5
CWE-59 Aug 7, 2026
File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files
File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files.
When the file to be rotated is a symbolic link to a missing file, and the touch option is enabled, then the rotate method assumes that the file is absent (since the existence check is against the target), and does not rotate it. But it touches the file, which creates the target.
An attacker that has the ability to create the symlink can use this to create an arbitrary file with permissions of the process rotating the files (which may be different from the process that normally writes to the log file that is being rotated).
Note that the touch option is disabled by default.
CVE-2026-71556
High · 7.1
CWE-59 Aug 7, 2026
go-git: Worktree operations may follow symlinks
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.
CVE-2026-19008
Medium · 6.3
CWE-59 Aug 6, 2026
mf-yang openclaw-cn apply_patch Tool sandbox-paths.ts assertNoSymlinkEscape link following
A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component apply_patch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-70427
Medium · 4.3
CWE-59 Aug 5, 2026
Link Following in Jenkins
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary locations on the file system, restricted only by file system access permissions of the user running Jenkins.
CVE-2026-20310
Critical · 9.1
CWE-59 Aug 5, 2026
Cisco SD-WAN Software Security Hardening Release - Improper Link Resolution Before File Access
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-20310 are related to improper link resolution before file access issues that are grouped under the Common Weakness Enumeration (CWE) CWE-59.
CVE-2026-12410
High · 7.8
CWE-59 Aug 5, 2026
CCleaner local privilege escalation via link following on uninstall
Link following vulnerability in the Uninstaller component in CCleaner prior to 7.10.1464 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM via a symlink/junction created during application uninstallation, which CCleaner follows when deleting the application's data folder with elevated integrity.
CVE-2026-40717
High · 7.8
CWE-59 Aug 3, 2026
Link Following in Dell Monitor Driver
Dell Monitor driver, version 1.0.0.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.