CWE-59

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107608",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T19:53:47.481985Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T19:53:59.498Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "aws-cdk-lib",
          "vendor": "AWS",
          "versions": [
            {
              "lessThan": "2.267.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:aws:aws-cdk-lib:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.267.0",
                  "versionStartIncluding": "0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset.\u003c/p\u003e\u003cp\u003eTo remediate this issue, users should upgrade to version 2.267.0 or later.\u003c/p\u003e"
            }
          ],
          "value": "Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-dependent actor to cause files from the build host to be published as the deployed asset.\n\n\n\nTo remediate this issue, users should upgrade to version 2.267.0 or later."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-132",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-132 Symlink Attack"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper link resolution before file access (\u0027link following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T19:36:53.715Z",
        "orgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
        "shortName": "AMZN"
      },
      "references": [
        {
          "tags": [
            "patch",
            "release-notes"
          ],
          "url": "https://github.com/aws/aws-cdk/releases/tag/v2.267.0"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://aws.amazon.com/security/security-bulletins/2026-131-aws/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Improper link resolution in asset bundling output handling in aws-cdk-lib",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ff89ba41-3aa1-4d27-914a-91399e9639e5",
    "assignerShortName": "AMZN",
    "cveId": "CVE-2026-107608",
    "datePublished": "2026-10-08T19:36:53.715Z",
    "dateReserved": "2026-10-08T13:07:54.035Z",
    "dateUpdated": "2026-10-08T19:53:59.498Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-107578",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T14:17:49.322792Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T14:17:57.729Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "hMailServer",
          "repo": "https://gitlab.com/hmailserver/hmailserver",
          "vendor": "Progressive Robot Ltd",
          "versions": [
            {
              "lessThan": "6.3.6",
              "status": "affected",
              "version": "6.3.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Found in the hMailServer project\u0027s own security review (Progressive Robot Ltd)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6.3.4 and 6.3.5 allow a local attacker who already runs code as the low-privilege service account to escalate privilege. On Windows, operations run with administrator rights by the installer, DBSetup, the Control Panel or an administrator wrote log entries and crash records into the log folder, created, deleted and changed the permissions of the self-signed certificate and private key in the data folder, and rewrote message files in the data folder, all by path in folders the service account (NT SERVICE\\hMailServer, the default for new installations since 6.3.4) can modify, following junctions and mount points; and the store-maintenance operations reached files by names taken from the database, which the service account can write, including names outside the data folder. On Linux, the store-maintenance and object-storage operations run as root followed symbolic links the service account (the packaged hmailserver user, which owns the data folder) planted in it, so a root-run operation read, wrote or removed the link\u0027s target as root. A local attacker controlling the service account can thereby gain the administrator\u0027s (Windows) or root\u0027s (Linux) privileges when such an operation is run."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T11:47:01.083Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/71"
        },
        {
          "url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to hMailServer 6.3.6, in which every administrative command writes nothing to the logs and arms no crash recorder, writes the certificate only through folders held open and checked from the drive\u0027s root, reaches no file a database row names outside the data folder, and walks the data folder before any store command - going through a junction or mount point only when the administrators alone own and control it and refusing any other; and on Linux a store or object-storage command run as root first drops to the service account, so it follows no link that account planted. Until then: on Windows run the service as LocalSystem, or stop the service and check the program folder\u0027s Logs, Data, Temp and Database folders for junctions, mount points and symbolic links and that no message row names a path outside the data folder; on Linux run the store commands only as the service user, never as root."
        }
      ],
      "title": "Improper Link Resolution Before File Access (\u0027Link Following\u0027) in hMailServer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2026-107578",
    "datePublished": "2026-10-08T11:47:01.083Z",
    "dateReserved": "2026-10-08T10:51:55.636Z",
    "dateUpdated": "2026-10-08T14:17:57.729Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106508",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-09T01:56:28.353880Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-09T01:56:38.002Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "backstage",
          "vendor": "backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.54.6"
            }
          ]
        },
        {
          "product": "plugin-techdocs-node",
          "vendor": "@backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.15.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by potential file exposure through local techdocs publisher. When using the local TechDocs publisher (techdocs.publisher.type: \u0027local\u0027), it was possible for the documentation serving endpoint to follow filesystem references outside the intended documentation tree, potentially exposing host files to authenticated users. This is mitigated by the fact that exploration requires preconditions that do not arise through normal MkDocs operation. Cloud-based publishers (S3, GCS, Azure Blob Storage) are not affected. This issue is fixed in version 1.15.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T21:47:35.516Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/backstage/backstage/security/advisories/GHSA-cm77-ch27-6w6v",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/backstage/backstage/security/advisories/GHSA-cm77-ch27-6w6v"
        },
        {
          "name": "https://github.com/backstage/backstage/commit/6aecb26f337ffec1d4e67ce903cf1e39b6082ec4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/commit/6aecb26f337ffec1d4e67ce903cf1e39b6082ec4"
        },
        {
          "name": "https://github.com/backstage/backstage/releases/tag/v1.54.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"
        }
      ],
      "source": {
        "advisory": "GHSA-cm77-ch27-6w6v",
        "discovery": "UNKNOWN"
      },
      "title": "Backstage: Potential file exposure through local TechDocs publisher"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-106508",
    "datePublished": "2026-10-06T21:47:35.516Z",
    "dateReserved": "2026-10-06T18:46:47.767Z",
    "dateUpdated": "2026-10-09T01:56:38.002Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106507",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T15:03:07.022146Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T15:03:20.623Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "backstage",
          "vendor": "backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.54.6"
            }
          ]
        },
        {
          "product": "plugin-techdocs-node",
          "vendor": "@backstage/plugin-techdocs-node",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.15.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree handling allows an authenticated user who can register documentation sources to include content from outside the intended documentation boundary. Depending on deployment, this may expose files readable by the build process. This issue is fixed in version 1.15.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-61",
              "description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T21:46:08.014Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/backstage/backstage/security/advisories/GHSA-vmqh-7cj9-mvcj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/backstage/backstage/security/advisories/GHSA-vmqh-7cj9-mvcj"
        },
        {
          "name": "https://github.com/backstage/backstage/commit/911ca36f10e654c5517da029129230fc05a4f580",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/commit/911ca36f10e654c5517da029129230fc05a4f580"
        },
        {
          "name": "https://github.com/backstage/backstage/releases/tag/v1.54.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"
        }
      ],
      "source": {
        "advisory": "GHSA-vmqh-7cj9-mvcj",
        "discovery": "UNKNOWN"
      },
      "title": "Backstage: TechDocs arbitrary file read via mkdocs snippets"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-106507",
    "datePublished": "2026-10-06T21:46:08.014Z",
    "dateReserved": "2026-10-06T18:46:47.766Z",
    "dateUpdated": "2026-10-07T15:03:20.623Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106500",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T15:47:41.478403Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T15:48:01.118Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "backstage",
          "vendor": "backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.49.6"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.50.0-next.0, \u003c 1.50.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 1.51.0-next.0, \u003c 1.54.6"
            }
          ]
        },
        {
          "product": "plugin-scaffolder-backend",
          "vendor": "@backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.3.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 3.4.0, \u003c 3.4.1"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.4, \u003c 4.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated user with permission to create and access Scaffolder tasks may, under specific timing and deployment conditions, affect files accessible to the Backstage backend. If backend application files are writable, the confidentiality, integrity, and availability of the backend may be compromised. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T21:29:10.626Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/backstage/backstage/security/advisories/GHSA-xvgh-hmx8-9xxf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/backstage/backstage/security/advisories/GHSA-xvgh-hmx8-9xxf"
        },
        {
          "name": "https://github.com/backstage/backstage/commit/0d24f1b8701f3dde6cd597f81997c1ea873a43ae",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/commit/0d24f1b8701f3dde6cd597f81997c1ea873a43ae"
        },
        {
          "name": "https://github.com/backstage/backstage/commit/56be299dd3ef6706e13e76ea2f8a9b0dd0b6413d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/commit/56be299dd3ef6706e13e76ea2f8a9b0dd0b6413d"
        },
        {
          "name": "https://github.com/backstage/backstage/commit/9e86c95a1a3ddfd54db03731cd8678aa63495175",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/commit/9e86c95a1a3ddfd54db03731cd8678aa63495175"
        },
        {
          "name": "https://github.com/backstage/backstage/releases/tag/v1.49.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/releases/tag/v1.49.6"
        },
        {
          "name": "https://github.com/backstage/backstage/releases/tag/v1.50.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/releases/tag/v1.50.5"
        },
        {
          "name": "https://github.com/backstage/backstage/releases/tag/v1.54.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"
        }
      ],
      "source": {
        "advisory": "GHSA-xvgh-hmx8-9xxf",
        "discovery": "UNKNOWN"
      },
      "title": "Backstage: Improper task state validation in Scaffolder backend"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-106500",
    "datePublished": "2026-10-06T21:29:10.626Z",
    "dateReserved": "2026-10-06T18:46:47.766Z",
    "dateUpdated": "2026-10-07T15:48:01.118Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-106486",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-07T16:21:14.423550Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-07T16:22:11.503Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "backstage",
          "vendor": "backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.54.6"
            }
          ]
        },
        {
          "product": "plugin-scaffolder-backend-module-bitbucket-cloud",
          "vendor": "@backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.3.10"
            }
          ]
        },
        {
          "product": "plugin-scaffolder-backend-module-bitbucket-server",
          "vendor": "@backstage",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.2.25"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder actions did not sufficiently validate filesystem paths. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area, potentially compromising backend confidentiality, integrity, or availability. This issue is fixed in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server 0.2.25."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T20:35:10.380Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/backstage/backstage/security/advisories/GHSA-g8rx-f7m5-7794",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/backstage/backstage/security/advisories/GHSA-g8rx-f7m5-7794"
        },
        {
          "name": "https://github.com/backstage/backstage/commit/818528e112c36167d76187e9e63fb518399c4dd2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/commit/818528e112c36167d76187e9e63fb518399c4dd2"
        },
        {
          "name": "https://github.com/backstage/backstage/releases/tag/v1.54.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/backstage/backstage/releases/tag/v1.54.6"
        }
      ],
      "source": {
        "advisory": "GHSA-g8rx-f7m5-7794",
        "discovery": "UNKNOWN"
      },
      "title": "Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-106486",
    "datePublished": "2026-10-06T20:35:10.380Z",
    "dateReserved": "2026-10-06T18:46:47.765Z",
    "dateUpdated": "2026-10-07T16:22:11.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105081",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T18:35:34.310390Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T18:35:47.989Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ImageMagick",
          "vendor": "ImageMagick",
          "versions": [
            {
              "lessThan": "7.1.2-33",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.1.2-33",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "ImageMagick",
          "vendor": "ImageMagick",
          "versions": [
            {
              "lessThan": "6.9.13-58",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.9.13-58",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.2-33",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:imagemagick:imagemagick:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.13-58",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Scott Moore - VulnCheck"
        }
      ],
      "datePublic": "2026-10-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 2,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T13:10:29.543Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-79p5-w6jv-r997)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-79p5-w6jv-r997"
        },
        {
          "name": "VulnCheck Advisory: ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/imagemagick-before-7.1.2-33-policy-bypass-via-symlink-in-isrightsauthorizedbyname"
        }
      ],
      "title": "ImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-105081",
    "datePublished": "2026-10-12T13:10:29.543Z",
    "dateReserved": "2026-10-03T00:43:57.788Z",
    "dateUpdated": "2026-10-13T18:35:47.989Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "FileRise",
          "vendor": "error311",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.23.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise validates archive entry names but extracts them directly into the authorized live destination before validating resolved paths. If that destination already contains a symlink to a directory outside the storage root, an authenticated non-administrator with extract permission who can upload or otherwise place an attacker-controlled ZIP in that folder can place an ordinary archive entry beneath the link. ZipArchive::extractTo() can then overwrite an external file, and post-extraction cleanup can delete that target through the same linked parent, only where the FileRise process has the required filesystem write or removal permission. The advisory does not establish that the attacker can create the prerequisite symlink through FileRise. This issue is fixed in version 3.23.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T20:44:29.439Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/error311/FileRise/security/advisories/GHSA-jp22-hh6w-mpwp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/error311/FileRise/security/advisories/GHSA-jp22-hh6w-mpwp"
        },
        {
          "name": "https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984c68a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/error311/FileRise/commit/cc1118923b522baff28dca05bdd79c27f984c68a"
        },
        {
          "name": "https://github.com/error311/FileRise/releases/tag/v3.23.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/error311/FileRise/releases/tag/v3.23.0"
        }
      ],
      "source": {
        "advisory": "GHSA-jp22-hh6w-mpwp",
        "discovery": "UNKNOWN"
      },
      "title": "FileRise: Authenticated ZIP extraction follows a pre-existing symlink and deletes files outside the storage root"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-104109",
    "datePublished": "2026-10-14T20:44:29.439Z",
    "dateReserved": "2026-10-01T18:05:14.173Z",
    "dateUpdated": "2026-10-14T20:44:29.439Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-104103",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T13:52:07.698258Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T15:06:47.154Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ludwig",
          "vendor": "ludwig-ai",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.17.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extract_archive() validated tar member names before calling TarFile.extractall() but did not validate symlink members or hard-link members. A crafted archive could create a link that escaped the extraction directory and then write a later member through that link, placing attacker-controlled content at an arbitrary filesystem path with the extracting process\u0027s privileges. The same containment check used os.path.commonprefix, so a sibling path sharing the destination\u0027s character prefix could also pass. The dataset-loading path can download and extract configured archive URLs, but exploitation requires a user to process an archive from a source controlled or compromised by the attacker on supported Python 3.12 and 3.13 runtimes. Python 3.14 is not affected because its default tar data filter rejects escaping links. This issue is fixed in version 0.17.8."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T18:09:23.015Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/ludwig-ai/ludwig/security/advisories/GHSA-qvrm-3x4c-rcxf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/ludwig-ai/ludwig/security/advisories/GHSA-qvrm-3x4c-rcxf"
        },
        {
          "name": "https://github.com/ludwig-ai/ludwig/commit/7f534f31e725cc5362c8f6f85537488443de279a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ludwig-ai/ludwig/commit/7f534f31e725cc5362c8f6f85537488443de279a"
        },
        {
          "name": "https://github.com/ludwig-ai/ludwig/releases/tag/v0.17.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/ludwig-ai/ludwig/releases/tag/v0.17.8"
        }
      ],
      "source": {
        "advisory": "GHSA-qvrm-3x4c-rcxf",
        "discovery": "UNKNOWN"
      },
      "title": "Ludwig: Path traversal in dataset archive extraction allows arbitrary file write via symlink members"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-104103",
    "datePublished": "2026-10-14T18:09:23.015Z",
    "dateReserved": "2026-10-01T18:05:14.173Z",
    "dateUpdated": "2026-10-15T15:06:47.154Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-103975",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T15:03:46.584203Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T15:05:50.270Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "appium",
          "vendor": "appium",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 7.2.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside the extraction directory and then accepts a later regular-file entry whose legitimate name resolves through that link. The lexical containment check examines entry names without validating the symlink target or the real destination, so an attacker-controlled archive can write files to arbitrary locations writable by the Appium process. This is distinct from the earlier parent-directory entry-name traversal fixed in 7.0.6 because the bypass uses no parent-directory or absolute entry name. Depending on the writable destination, the arbitrary file write can overwrite configuration, startup scripts, or executables and lead to code execution. This issue is fixed in version 7.2.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T18:10:26.398Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/appium/appium/security/advisories/GHSA-qfxx-c367-67f8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/appium/appium/security/advisories/GHSA-qfxx-c367-67f8"
        },
        {
          "name": "https://github.com/appium/appium/pull/22436",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/appium/appium/pull/22436"
        },
        {
          "name": "https://github.com/appium/appium/commit/d9eb36f413153e28b04b92d8ce4447da270371c0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/appium/appium/commit/d9eb36f413153e28b04b92d8ce4447da270371c0"
        },
        {
          "name": "https://github.com/appium/appium/releases/tag/@appium/support@7.2.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/appium/appium/releases/tag/@appium/support@7.2.6"
        }
      ],
      "source": {
        "advisory": "GHSA-qfxx-c367-67f8",
        "discovery": "UNKNOWN"
      },
      "title": "Appium: Symlink based Zip Slip in @appium/support ZIP extraction"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-103975",
    "datePublished": "2026-10-14T18:10:26.398Z",
    "dateReserved": "2026-10-01T16:09:08.456Z",
    "dateUpdated": "2026-10-15T15:05:50.270Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}