By weakness (CWE)

CWE-59: related vulnerabilities

CVEs classified under CWE-59. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

56 published vulnerabilities

• CVE-2026-41236HIGH 8.8

  Froxlor version 2.3.6 contains a privilege escalation vulnerability in its SSH key synchronization mechanism for FTP users. An attacker with shell access to a customer account can exploit a symlink-following flaw to redirect the root-owned SSH key provisioning process into writing unauthorized keys to the system root account, granting SSH access as root. This vulnerability requires prior authentication and file system access on the affected system but results in complete system compromise.

• CVE-2026-55607HIGH 8.8

  Claude Code versions 2.1.38 through 2.1.162 contain a sandbox escape vulnerability that allows attackers to execute arbitrary code on a user's machine outside the seatbelt sandbox. The flaw stems from improper handling of git worktrees, which can be manipulated to create directories named ".git" and access files outside the intended sandbox boundaries. An attacker can exploit this by hosting a malicious repository containing prompt injection content; when a user clones the repository and runs Claude Code against it, symlink manipulation and git fsmonitor execution during worktree operations can overwrite critical shell configuration files (such as .zshenv) in the user's home directory, achieving code execution with the user's privileges.

• CVE-2026-14891HIGH 8.7

  HashiCorp Nomad—a popular container orchestration and workload scheduling platform—contains a vulnerability in its Docker task driver that allows someone with job submission privileges to circumvent security controls and mount host filesystem paths into containers. Even when administrators explicitly disable volume bind mounts as a security measure, an attacker can still access host files by exploiting this flaw. This could lead to unauthorized reading or modification of sensitive data on the underlying host system. The issue affects both the open-source Community Edition and the commercial Enterprise Edition across multiple versions.

• CVE-2026-55667HIGH 8.2

  File Browser, a multi-tenant file management system, contains a critical authorization bypass vulnerability in versions prior to 2.63.16. An authenticated user with only basic file creation permissions can delete arbitrary files outside their assigned scope—including other tenants' data and the application's own database—by exploiting a symlink following flaw in the failed-upload cleanup routine. The vulnerability exists because the RemoveAll operation skips symlink validation that other file operations enforce, allowing a low-privilege user to chain directory escape and deletion in a single attack.

• CVE-2026-35025HIGH 8.1

  ProFTPD versions through 1.3.9b and 1.3.10rc2 contain a flaw that allows authenticated FTP users to bypass directory access controls. By manipulating file paths in rename commands using a /proc/self/root prefix, attackers can circumvent restrictions meant to prevent access to sensitive directories. The vulnerability enables them to rename files in restricted areas and then download those files, effectively gaining unauthorized access to protected content. Systems using ProFTPD's chroot feature (DefaultRoot) are protected from this issue.

• CVE-2026-23879HIGH 8.0

  py7zr is a Python library used to work with 7zip archives. A flaw in versions 1.1.2 and earlier allows an attacker to craft a malicious archive containing symbolic links that, when extracted, write files outside the intended destination folder. By chaining symbolic links, an attacker can bypass the library's directory boundary protections and write arbitrary files to the system. This could lead to code execution, privilege escalation, or data corruption depending on what files are overwritten and where.

• CVE-2026-42989HIGH 7.8

  CVE-2026-42989 is a local privilege escalation vulnerability in Windows Winlogon—the system component responsible for user authentication and session management. An attacker who already has basic user-level access to a Windows machine can exploit a flaw in how Winlogon resolves file links, allowing them to gain full administrative control. The vulnerability does not require user interaction and affects multiple versions of Windows 10, Windows 11, and Windows Server platforms.

• CVE-2026-44274HIGH 7.8

  Dell Wyse Management Suite (WMS) contains a flaw that allows an attacker with basic user privileges and local system access to bypass file access controls through improper link resolution. This could enable unauthorized access to sensitive system files or data that the attacker should not normally be able to read or modify. The vulnerability affects all versions before WMS 2605 and requires the attacker to already have a user account on the affected system.

• CVE-2026-45586HIGH 7.8

  A flaw in Windows Collaborative Translation Framework allows a user with local access to escalate their privileges by exploiting how the system handles symbolic links and file access. An attacker who already has a standard user account can manipulate file paths to trick the system into accessing files with elevated permissions, gaining full control of the affected machine.

• CVE-2026-50511HIGH 7.8

  Microsoft PC Manager contains a privilege escalation vulnerability where an authorized local user can exploit improper link handling to gain elevated system privileges. The flaw stems from the application's failure to safely resolve symbolic or hard links before accessing files, allowing an attacker with standard user permissions to manipulate the system through link-following attacks. This is a local-only vulnerability requiring existing access to the affected system.

• CVE-2026-50656HIGH 7.8

  Microsoft Defender's Malware Protection Engine contains a vulnerability that allows a local user to gain elevated privileges on a system. Tracked as 'RoguePlanet,' this flaw requires an attacker to already have local access and does not require user interaction to exploit. The vulnerability grants high-level system permissions, potentially allowing an attacker to read sensitive data, modify system files, or disable security controls.

• CVE-2026-9804HIGH 7.7

  KubeVirt's virt-exportserver contains a path traversal flaw that allows authenticated attackers with namespace-level access to read arbitrary files from the exporter pod. An attacker can exploit this by placing a symbolic link in an exported filesystem that points outside its intended boundary, effectively bypassing file access restrictions and exposing sensitive data stored on the pod.

• CVE-2026-54056HIGH 7.6

  Kitty, a GPU-accelerated terminal emulator used across multiple platforms, has a flaw in its drag-and-drop handling that can allow an attacker to write files to unintended locations on a user's system. When a user drags and drops files from a remote source into Kitty (versions 0.47.0 and 0.47.1), the application stages those files in a temporary directory. An attacker can exploit a race condition combined with symlink handling to cause Kitty to write to files outside the staging area—potentially overwriting or truncating important files that the Kitty user has access to. The vulnerability requires user interaction (the user must perform a drag-and-drop action) and works only on case-sensitive filesystems, which narrows but does not eliminate the risk.

• CVE-2026-39246HIGH 7.5

  The decompress library before version 4.2.2 has a vulnerability that allows attackers to create arbitrary symbolic links (symlinks) when extracting archive files. An attacker can craft a malicious archive that, when extracted, creates symlinks pointing to sensitive system files outside the intended extraction directory. This could allow an attacker to trick the application into reading or exposing sensitive information like system passwords. The vulnerability requires no authentication and can be triggered remotely if the application processes untrusted archives.

• CVE-2026-54094HIGH 7.5

  File Browser, a file management interface used for uploading, deleting, previewing, renaming, and editing files, contains a symlink-following vulnerability that allows attackers to escape the intended directory scope. Before version 2.63.14, the HTTP file handlers do not validate symlink targets before serving or accessing files. This means a user with restricted access to a specific directory—or even an unauthenticated user with public-share permissions—can craft a symlink with a path that appears to be within their allowed scope but actually points to files outside that boundary. An attacker can exploit this to read, write, or enumerate sensitive files outside the intended scope.

• CVE-2026-57991HIGH 7.4

  Microsoft Edge (Chromium-based) contains a flaw in how it resolves symbolic links and shortcuts before accessing files. An attacker can craft a malicious link that, when clicked by a user, causes Edge to follow the link to an unintended location and disclose sensitive information over the network. The vulnerability requires user interaction (clicking the link) but does not require authentication and can affect systems across a network.

• CVE-2026-11837HIGH 7.3

  A vulnerability in Ansible's posix authorized_key module allows a local user to escalate their privileges to root. The flaw stems from how the module handles SSH key file operations: it follows symbolic links when changing file ownership instead of operating directly on the link itself. An attacker with a local account can create malicious symbolic links in their .ssh directory, then wait for a system administrator to run an Ansible task that manages authorized keys with elevated privileges. When that happens, the module will change ownership of arbitrary files on the system—potentially giving the attacker control over critical system files and full system access.

• CVE-2026-41121HIGH 7.3

  Dell Device Management Agent versions before 26.05 contain a link-following vulnerability that allows a low-privileged local attacker to escalate their privileges on an affected system. An attacker with basic user access could exploit a flaw in how the agent resolves file links to gain elevated permissions, potentially taking full control of the system.

• CVE-2026-49135HIGH 7.1

  CodexBar versions before 0.32.0 have a serious flaw in how they handle temporary files during the app release and notarization process. An attacker with access to the same machine can steal the App Store Connect API credentials or sabotage the build artifacts before they're submitted to Apple. The vulnerability exists because CodexBar writes sensitive files to predictable, fixed locations that any local user can read or manipulate.

• CVE-2026-54369HIGH 7.1

  A vulnerability in the acl library before version 2.4.0 allows local users to escalate their privileges by exploiting how the library handles file paths. An attacker who can control any part of a file path—such as a directory name—can replace it with a symbolic link to redirect the library's ACL (Access Control List) operations to different files or directories than intended. This misdirection lets them read or modify access permissions on files they shouldn't be able to touch, ultimately gaining higher privileges on the system.

• CVE-2026-54371HIGH 7.1

  CVE-2026-54371 is a local privilege escalation flaw in the attr package (getfattr and setfattr tools) versions before 2.6.0. An attacker with local access can exploit a symlink traversal weakness to redirect these utilities to operate on arbitrary files. When a privileged process runs getfattr or setfattr over a path the attacker controls, the attacker can substitute a symbolic link in the directory chain to make the operation target a different file—effectively gaining elevated privileges without additional authentication.

• CVE-2026-54230HIGH 7.0

  A vulnerability in libreport's ABRT (Automatic Bug Reporting Tool) event handler scripts allows a local attacker with limited privileges to overwrite arbitrary files on a system. The flaw occurs because event scripts use file output redirection without protective measures that would prevent following symbolic links. An attacker can replace a target file with a symlink pointing to a sensitive system file, then trigger an ABRT event. Since the event scripts run as root, they unwittingly follow the symlink and write data to the attacker's chosen location, potentially corrupting critical system files or planting malicious content.

• CVE-2026-11322MEDIUM 6.5

  Hermes WebUI versions before 0.51.221 have a path traversal flaw that lets authenticated users read files outside the intended workspace directory. By crafting symlinks that point to sensitive data, attackers can access SSH keys, cloud credentials, and application tokens that the server process can reach. The vulnerability requires an existing user account but poses a meaningful risk to credential and secret exposure.

• CVE-2026-11853MEDIUM 6.5

  Debusine, a tool for building and maintaining Debian-based Linux distributions, contains a vulnerability in how it parses Debian package manifest files (.dsc and .changes files). These manifests list the files that make up a software package. An attacker can craft malicious manifest files that trick Debusine's parser into creating symbolic links (shortcuts) pointing anywhere on the system. If exploited during the "mergeuploads" task, this could allow an attacker to overwrite files that the Debusine worker process has permission to access, potentially compromising the integrity of package builds or the system itself.

• CVE-2026-14904MEDIUM 6.5

  AWS Research and Engineering Studio (RES) contains a flaw that allows authenticated users to read any file on the cluster-manager server by exploiting how the system handles SSH key uploads. An attacker with valid credentials can replace their SSH private key with a symbolic link pointing to sensitive files elsewhere on the server. Because the cluster-manager process runs with root privileges, this exposes files that should be restricted, including other users' SSH keys and application secrets. This is a privilege-escalation risk that requires valid authentication to exploit, but once inside, the attacker gains broad file-read access they shouldn't have.

• CVE-2026-40861MEDIUM 6.5

  CVE-2026-40861 is a path traversal vulnerability in Apache Airflow that allows a DAG (Directed Acyclic Graph) author to read or write arbitrary files on the system when the worker and API server share a log directory. An attacker with DAG authoring privileges can either create symbolic links in their task's log folder to access sensitive files like `/etc/passwd` or `airflow.cfg`, or inject path traversal sequences (`..`) in task IDs to escape the intended log directory. The vulnerability exposes confidential configuration data and could enable file overwrites on the API server's filesystem.

• CVE-2026-47277MEDIUM 6.5

  Runtipi, a personal homeserver orchestrator, contains a vulnerability that allows unauthenticated users to read arbitrary files from the host system through its app marketplace logo endpoint. When Runtipi clones third-party app repositories, an attacker can craft a malicious app store that includes a symbolic link disguised as a logo file. Since the logo endpoint doesn't properly validate symlink targets, requesting this logo causes Runtipi to follow the symlink and return sensitive files like environment variables, JWT secrets, or application logs to the requester. This affects Runtipi versions 4.9.1 through 4.9.3 and has been patched in version 4.10.0.

• CVE-2026-58403MEDIUM 6.5

  Hugo, a popular static site generator, has a flaw in how it manages file access within mount boundaries. Versions 0.123.0 through 0.163.0 allow a symlink placed inside a theme or local mount to bypass directory restrictions and read arbitrary files from the server. An attacker who can contribute a malicious theme or alter a mounted directory could exploit this to access sensitive files that the Hugo process can read. The vulnerability requires user interaction—the user must run Hugo—but poses a meaningful confidentiality risk in collaborative or shared hosting environments. This has been patched in v0.163.1.

• CVE-2026-44275MEDIUM 6.3

  Dell and Alienware's Purchased Apps service contains a vulnerability in versions before 1.1.32.0 that allows a low-privileged local user to write arbitrary files to the system by exploiting improper handling of file system links. An attacker with local access could redirect file operations through symbolic links or similar mechanisms to overwrite sensitive files, potentially compromising system integrity or enabling privilege escalation.

• CVE-2026-55668MEDIUM 6.3

  File Browser is a web-based file management application. Versions before 2.63.16 contain a flaw in how they validate symbolic links (symlinks) during file creation. When a user with file creation and modification permissions attempts to create a file via a dangling symlink—one pointing to a non-existent target—the application checks whether the symlink's nearest existing parent directory is within the user's allowed scope. If it passes that check, the application follows the symlink and creates the file at the symlink's target location, which may lie outside the user's intended scope. An authenticated attacker can exploit this to write files to directories they should not have access to.

• CVE-2026-45491MEDIUM 6.2

  A flaw in .NET's file handling allows an attacker with local access to manipulate files through improper link resolution. The vulnerability stems from the system failing to properly validate symbolic links or similar path references before opening files, which means an attacker could redirect file operations to unintended targets. While this requires local access and does not compromise confidentiality, it can lead to unauthorized modification of sensitive data or system files.

• CVE-2026-45384MEDIUM 6.1

  bit7z is a C++ library used by applications to handle file compression and extraction. Before version 4.0.12, the library had a flaw in how it created temporary files when updating archives. An attacker with local access could exploit a predictable temporary file location to create a symbolic link that tricks the library into overwriting arbitrary files on the system. This is a classic symlink-attack vulnerability affecting local privilege escalation or data integrity scenarios.

• CVE-2026-46406MEDIUM 6.1

  Claude Code versions 2.1.59 through 2.1.128 had a local file handling vulnerability in the /copy command that could leak sensitive information or allow file manipulation. When the command executed, it wrote responses to a predictable location (/tmp/claude/response.md) with insufficient protections. Any user on the system could read files written there, potentially exposing secrets or credentials. Additionally, an attacker could plant a symlink at that location to trick the tool into overwriting arbitrary files with command output. This vulnerability requires local system access and relies on a privileged user running the /copy command, limiting its scope but creating real risk in multi-user or containerized environments.

• CVE-2026-47833MEDIUM 6.1

  CVE-2026-47833 is a privilege escalation flaw in bpm-release (all versions before 1.4.30) where a compromised container process can exploit symlink handling in the setupBpmLogs function to gain unauthorized access to host files. An attacker can trick the system into changing ownership of arbitrary files—most critically /etc/shadow—to the vcap user, then read sensitive password hashes. This represents a container-to-host boundary breach affecting every job managed by bpm.

• CVE-2026-53765MEDIUM 6.1

  Chrome DevTools for agents (chrome-devtools-mcp) is a tool that allows coding agents to control and inspect a live Chrome browser. Versions 0.20.0 through 1.0.x contain a local privilege escalation vulnerability affecting macOS and Linux systems. An attacker with local access to the same machine can exploit predictable file paths to write a symlink that causes the application to overwrite files belonging to higher-privileged users when the daemon starts. The vulnerability has been fixed in version 1.1.0.

• CVE-2026-53766MEDIUM 6.1

  Chrome DevTools for agents (chrome-devtools-mcp) contains a path validation flaw that allows an attacker with local access to bypass workspace boundary restrictions. By placing symbolic links inside an authorized workspace directory that point to files outside that boundary, an attacker can read sensitive files or overwrite files they should not have access to. This circumvents the security controls meant to confine agent operations to specific directories. The vulnerability affects versions 0.24.0 through 1.0.x and is resolved in version 1.1.0.

• CVE-2026-56236MEDIUM 6.1

  Capgo CLI, a command-line tool used by developers, has a flaw that allows attackers to trick it into overwriting files or exposing sensitive credentials. If a developer clones or works in a repository controlled by an attacker, the attacker can plant symbolic links (shortcuts to files) that cause the CLI to write to unintended locations on the developer's computer when they log in or build their application. The credentials file may also end up readable by anyone on that machine.

• CVE-2026-28262MEDIUM 6.0

  Dell iDRAC Tools versions before 11.4.1.0 contain a symlink-following vulnerability that allows a low-privileged user with local system access to tamper with files on the affected system. An attacker would need to already have some level of local access and user interaction to exploit this, making it a localized threat rather than a remotely exploitable vulnerability. The primary risk is unauthorized modification of system or application data rather than information disclosure.

• CVE-2025-46293MEDIUM 5.5

  CVE-2025-46293 is a local privilege escalation vulnerability in macOS that allows installed applications to read protected user data through improper symlink handling. An attacker with local access and the ability to run an app on the target system could potentially bypass file access restrictions and view sensitive files. The vulnerability requires local presence and user-level privileges to exploit, making it a concern primarily for multi-user systems or scenarios where an attacker can install malicious software. Apple has resolved this with improved symlink validation in macOS Sequoia 15.4.

• CVE-2026-39243MEDIUM 5.5

  decompress before version 4.2.2 contains a vulnerability that allows attackers to create hardlinks to arbitrary files on a system during archive extraction. When a malicious archive is extracted, an attacker can craft hardlink entries that point to sensitive files elsewhere on the filesystem, creating a link inside the extraction directory that shares the same underlying file. This enables the attacker to read the contents of files they shouldn't have access to, or potentially modify those files. The vulnerability requires user interaction (extracting an archive) but doesn't require elevated privileges to exploit.

• CVE-2026-50135MEDIUM 5.5

  Hugo, a popular static site generator, contains a vulnerability in versions 0.123.0 through 0.161.1 that allows arbitrary file read when a symlink is present in local theme directories. If an attacker or compromised dependency places a malicious symlink in a theme folder (such as under `themes/`), Hugo's `resources.Get` function will follow that symlink and expose files readable by the Hugo process—potentially including sensitive configuration, environment variables, or other data. This affects only locally-mounted themes; remotely sourced Go modules from GitHub are unaffected because symlinks are stripped during download. The issue stems from a regression where the file system backend began using `Stat` (which follows symlinks) instead of `Lstat` (which does not).

• CVE-2026-56692MEDIUM 5.5

  NanoClaw versions before 2.1.17 contain a symlink-following vulnerability that allows malicious container agents to read sensitive files from the host system. When the host processes file attachments, it validates filenames using a safety check but then copies files without verifying whether those filenames point to symlinks. An attacker controlling a container agent can craft a symlink with a seemingly benign name to trick the host into copying and exposing arbitrary files it can access, leading to information disclosure.

• CVE-2026-58198MEDIUM 5.5

  ChatterBot versions before 1.2.14 contain a local privilege escalation vulnerability in how it extracts training data. The vulnerability exists because the software creates a predictable directory in a user's home folder and extracts compressed files into it without properly validating the destination. A local attacker who already has access to the system can create a symbolic link at the expected directory location, tricking the software into writing files to any directory they choose on the system. This requires an attacker to already have local access and knowledge of when the extraction will occur, limiting the immediate risk—but it can lead to unauthorized file manipulation within the system.

• CVE-2026-58203MEDIUM 5.3

  pydantic-settings is a Python library that manages application configuration through Pydantic models. Versions 2.12.0 through 2.14.1 contain a flaw in how they handle secret files stored in a designated secrets directory. When the nested subdirectory feature is enabled, the library will follow symbolic links (shortcuts) that point outside the intended secrets directory, allowing it to read arbitrary files from the system. An attacker with write access to the secrets directory—such as in a shared or world-writable mount—can create malicious symbolic links to trick the application into loading sensitive files from anywhere on the system. This also bypasses the documented size limit protection meant to prevent loading oversized files.

• CVE-2026-55443MEDIUM 5.1

  LangChain versions prior to 1.3.9 contain a path-traversal vulnerability that allows unauthorized file access. Several components that load or search files do not properly restrict access to a configured directory boundary. An attacker who can influence file paths, search patterns, or LLM inputs could read files outside the intended scope—for instance, by using glob patterns, symbolic links, or prefix-matching tricks to escape a restricted directory and access sensitive files elsewhere on the system.

• CVE-2026-54055MEDIUM 5.0

  Kitty, a popular GPU-accelerated terminal emulator, contains a local privilege escalation flaw in its file transmission protocol affecting versions before 0.47.2. A low-privileged user running a child process in the terminal can write files to arbitrary locations on the system by exploiting a race condition in how Kitty validates and creates files. An attacker would need local access and user interaction, but the window for exploitation is small and doesn't require special privileges to trigger.

• CVE-2026-6891MEDIUM 5.0

  A vulnerability in My Image Garden for macOS version 3.6.8 and earlier allows a logged-in user to manipulate the installer through specially crafted symbolic links, potentially gaining permission changes to files they shouldn't normally access. This is a local privilege escalation risk that requires both system access and user interaction during installation.

• CVE-2026-6892MEDIUM 5.0

  A flaw in Canon's CUPS printer driver installers for macOS allows a local attacker who has login access to a machine to manipulate symbolic links during the installation process. By crafting a malicious symbolic link, an attacker can trick the installer into changing file permissions on directories they shouldn't normally be able to modify. This is a local-only attack that requires an attacker to already have user-level access to the system.

• CVE-2026-46464MEDIUM 4.9

  Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7, along with specific LTS releases (8.6.1.0–8.6.1.10, 8.3.1.0–8.3.1.30, and 7.13.1.0–7.13.1.70), contain a link-following vulnerability that could allow a high-privileged remote attacker to access sensitive information. The flaw stems from improper validation of symbolic links or file path traversal before accessing files on the system. While the attack requires elevated privileges and does not permit system modification or unavailability, the potential for information disclosure in a data protection appliance warrants attention.

• CVE-2026-14361MEDIUM 4.7

  Consul-template versions before 0.42.1 contain a vulnerability in how the writeToFile template helper processes file paths. An attacker with local access and limited privileges could potentially craft a malicious template that writes output to unintended directories or overwrites existing files on the system. This is a local privilege escalation concern rather than a remote vulnerability, and requires active template manipulation to exploit.

• CVE-2026-44269MEDIUM 4.4

  Dell PowerProtect Data Domain contains a symlink-following vulnerability that allows an attacker with high-level local system access to read sensitive files they shouldn't be able to access. The flaw exists in versions 7.7.1.0 through 8.6, affecting multiple support branches (LTS2026, LTS2025, and LTS2024). While the attacker must already have elevated privileges on the system, the vulnerability could lead to unauthorized disclosure of confidential data stored on the backup appliance.

• CVE-2026-46468MEDIUM 4.4

  Dell PowerProtect Data Domain contains a vulnerability where the system doesn't properly check symbolic links before accessing files. An attacker with high-level local system access could exploit this to read sensitive information they shouldn't normally access. While the attack requires significant privileges and local access, the potential exposure of confidential data makes this a meaningful security concern for organizations relying on Data Domain for backup and archival operations.

• CVE-2026-14699LOW 3.3

  CVE-2026-14699 is a local symlink-following vulnerability in markdownify-mcp, a Markdown conversion tool. An attacker with local access and low-level privileges can manipulate file paths to cause the application to follow symbolic links, potentially reading files outside the intended directory. The risk is contained because exploitation requires direct local access and low-privilege user status.

• CVE-2026-14966LOW 3.1

  BBOT's unarchive module contains a symlink validation bypass in zip and 7z archives. The module is designed to reject archives containing symlinks before extraction, but it fails to detect symlinks when they are encoded with a DOS-attribute prefix before the Unix file mode—a format produced by legacy versions of p7zip. An attacker can craft such an archive and have it extracted during a scan (such as through file download operations), allowing a malicious symlink to be written to the extraction directory. The symlink itself is planted but its target is not accessed, limiting the immediate impact. The vulnerability only affects systems using legacy p7zip builds; current mainline 7-Zip is not vulnerable.

• CVE-2026-12567LOW 2.2

  CVE-2026-12567 is a local privilege escalation flaw in the github_workflows module that fails to validate repository names for symlink attacks. An attacker with local access to the scan directory can create a malicious symlink at a predictable output location, tricking the module into writing workflow data wherever the attacker directs. This requires local system access and user interaction, limiting immediate blast radius but creating a path for data exfiltration or code injection in multi-user or CI/CD environments.

• CVE-2026-45403LOW 2.0

  AnythingLLM versions before 1.13.0 contain a path traversal vulnerability in the agent filesystem copy tool. When copying files, the application only validates the top-level source and destination directories but fails to validate nested files or reject symbolic links. An attacker with high privileges could create or exploit a symlink nested within an allowed source directory to read files outside the intended filesystem boundaries and copy them to an allowed destination, potentially exposing sensitive data. The vulnerability requires high user privileges, complex conditions, and user interaction to exploit, making practical real-world abuse unlikely despite the core weakness.