{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "pwnlift symlink following",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Greg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "1. Advisory information\n-----------------------\nTitle:  Symlink following and TOCTOU in pwnlift upload handler allow arbitrary file write as root\nAdvisory: https://github.com/GregDurys/security-advisories\nGHSA: GHSA-2v7v-rhpw-m9w4\nCVE: CVE-2026-56815\nClass:  CWE-59 (Improper Link Resolution Before File Access), \nCWE-367 (Time-of-check Time-of-use Race Condition)\nCVSS:  7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nDate:  2026-06-27\nAuthor:  Greg Durys \u003chttps://github.com/GregDurys\u003e\n\n\n2. Affected software\n--------------------\nProject:  pwnlift\nRepository: https://github.com/rasta-mouse/pwnlift\nRuntime:  .NET / Blazor (ASP.NET Core, Kestrel)\nComponent:  pwnlift/Components/Pages/Home.razor\nTested:  commit 211f2b3 (2025-08-29)\nFix: d7a95449d9ee1ea09ec1529286685f6187afbbed (merged 2026-06-18),\n(initial remediation e3eddac addresses CWE-59 but not CWE-367)\n\n\n3. Testing scope\n----------------\nAll exploitation testing was performed in a local testbed. The known\naffected downstream lab deployment has been mitigated by removing the\nprivileged sudo entry. The upstream follow-up fix has been merged.\n\n\n4. Summary\n----------\npwnlift is a small .NET/Blazor file upload server. Its upload handler\nconstructs the destination path from the caller\u0027s working directory\n(Directory.GetCurrentDirectory()) and writes uploaded files without\nvalidating symlinks, canonicalising paths, or sanitising filenames.\n\nWhen pwnlift runs as root via sudo without a cwd= directive, a local\nuser can exploit this in two ways:\n\n  (a) Symlink following (CWE-59): pre-stage an Uploads symlink\n      pointing at a privileged directory. The elevated process follows\n      the symlink and writes uploaded files into the target.\n\n  (b) TOCTOU bypass of initial fix (CWE-367): the initial fix added\n      a ReparsePoint check and StartsWith containment. Because the\n      destination is still caller-controlled, a race script alternates\n      Uploads between a real directory (passes the check) and a symlink\n      (catches the write). The StartsWith check has a separate flaw:\n      prefix matching without a trailing separator means\n      /tmp/Uploads-evil passes StartsWith(\"/tmp/Uploads\").\n\nBoth variants achieve arbitrary file write as root. For example,\nwriting to a privileged configuration path such as /etc/sudoers.d/\ncan grant the attacker full passwordless sudo.\n\n\n5. Remediation\n--------------\nReplace Directory.GetCurrentDirectory() with AppContext.BaseDirectory.\nEnforce path containment with Path.GetRelativePath rather than\nStartsWith. Retain the ReparsePoint check as defence in depth. Ensure\nthe application directory and Uploads are root-owned and not writable\nby lower-privileged users. If Uploads already exists as a symlink,\nremove and recreate it as a real directory before applying ownership\nchanges.\n\n\n6. Disclosure timeline\n----------------------\n2026-04-30  Privileged deployment observed during normal lab usage\n2026-05-07  Initial contact with upstream maintainer\n2026-05-08  Reproduced end-to-end in local testbed; reported to upstream maintainer and downstream deployment operator\n2026-05-12  Initial fix committed upstream (e3eddac) with reporter credit\n2026-05-19  Downstream operator declined CVE on CNA scope grounds\n2026-05-20  TOCTOU bypass reproduced and reported to maintainer\n2026-05-28  Downstream operator confirmed lab patched, sudo removed\n2026-05-30  CVE requested via GHSA\n2026-06-09  GitHub rejected CVE request\n2026-06-09  GHSA re-review requested\n2026-06-15  CVE request submitted to MITRE\n2026-06-18  Follow-up fix merged upstream; CVE re-requested via GHSA\n2026-06-19  GitHub rejected second CVE request\n2026-06-22  GHSA advisory published without a CVE\n2026-06-23  Advisory posted to oss-security\n2026-06-23  MITRE assigned CVE-2026-56815\n\n\n7. Current status\n-----------------\nDownstream deployment: patched (sudo entry removed, 28 May 2026)\nUpstream final fix: merged (d7a9544, 18 June 2026)\nCVE: CVE-2026-56815 (assigned by MITRE, 23 June 2026)\n\n\n8. References\n-------------\n- https://github.com/rasta-mouse/pwnlift\n- https://github.com/rasta-mouse/pwnlift/commit/e3eddaca42b4b3e9c69f2d7aa024b6c82e27a5a2\n- https://github.com/rasta-mouse/pwnlift/commit/d7a95449d9ee1ea09ec1529286685f6187afbbed\n- https://github.com/rasta-mouse/pwnlift/security/advisories/GHSA-2v7v-rhpw-m9w4\n- https://www.openwall.com/lists/oss-security/2026/06/23/2\n- https://github.com/GregDurys/security-advisories\n- https://payloadforge.io/beyond-crto-pwnlift/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-59",
              "description": "CWE-59",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-07T13:20:21Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/10"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jul/10"
        },
        {
          "url": "https://github.com/GregDurys"
        },
        {
          "url": "https://github.com/GregDurys/security-advisories"
        },
        {
          "url": "https://github.com/rasta-mouse/pwnlift"
        },
        {
          "url": "https://github.com/rasta-mouse/pwnlift/commit/d7a95449d9ee1ea09ec1529286685f6187afbbed"
        },
        {
          "url": "https://github.com/rasta-mouse/pwnlift/commit/e3eddaca42b4b3e9c69f2d7aa024b6c82e27a5a2"
        },
        {
          "url": "https://github.com/rasta-mouse/pwnlift/security/advisories/GHSA-2v7v-rhpw-m9w4"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://payloadforge.io/beyond-crto-pwnlift/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/06/23/2"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jul/10"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "pwnlift: symlink following and TOCTOU in privileged upload handler allow arbitrary file write as root",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0095",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/10",
            "automated": true,
            "contentSha256": "0e587829355ffb3897c681893ea07a8e562007fe85cbd4c465bd4ac0631b48f2",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/10",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-27T11:36:46Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:21Z",
    "dateUpdated": "2026-09-07T13:20:21Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0095"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}