By weakness (CWE)

CWE-61: related vulnerabilities

CVEs classified under CWE-61. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

13 published vulnerabilities

• CVE-2026-56876HIGH 8.1

  extract-zip, a popular Node.js package for unzipping files, fails to validate symlink targets during extraction. An attacker can craft a malicious zip archive containing symlinks with path traversal sequences (e.g., '../../../../etc/passwd') that point outside the intended extraction directory. When the library extracts these symlinks without validation, it creates links to arbitrary filesystem locations. Depending on the application's usage pattern and file permissions, this could enable an attacker to read sensitive files or overwrite critical data.

• CVE-2026-12958HIGH 7.8

  Language Servers for AWS contain a flaw in how they validate symbolic links (symlinks). When a local user opens a workspace containing a maliciously crafted symlink, an attacker can trick the application into writing arbitrary files to locations outside the intended workspace boundary. This bypasses the trust controls that should prevent such access. An attacker would need local access to the machine and user interaction to open the malicious workspace, but successful exploitation could result in unauthorized file creation or modification on the system.

• CVE-2026-39822HIGH 7.8

  CVE-2026-39822 is a symlink-following vulnerability in Go's file handling on Unix systems. When opening a file through Go's os.Root abstraction, the system incorrectly follows symbolic links that point outside the intended root directory if the path ends with a forward slash. For example, attempting to open "symlink/" will follow the symlink even if it targets a location outside the root boundary. This allows a local attacker with user-level privileges to read, modify, or delete files they should not have access to.

• CVE-2026-56815HIGH 7.4

  pwnlift versions before commit d7a9544 contain a symlink-following vulnerability in their file upload handler. When deployed with elevated privileges, an attacker with local access could exploit this flaw to read or modify sensitive files on the system, or potentially execute code with the same privileges as the vulnerable application. This is a local attack that requires no user interaction to trigger.

• CVE-2026-13201HIGH 7.3

  KubeVirt's file path handling contains a symlink-following vulnerability that allows attackers with pod-level access to compromise virtual machine management. An attacker in a virt-launcher pod can intercept management socket communications, inject fake VM lifecycle events, or manipulate file ownership on host paths. The result is that virt-handler—the component responsible for VM lifecycle management—can be tricked into corrupting VM state, crashing, or denying service to all VMs on an affected node.

• CVE-2026-42306HIGH 7.2

  A race condition in Moby and Docker Engine allows a container to intercept and redirect bind mount operations to unintended host filesystem locations. A malicious or compromised container could exploit this timing window during the `docker cp` mount setup phase to write files to arbitrary paths on the host, potentially overwriting critical files or disrupting services. The vulnerability requires local access and user interaction, but poses significant risk in multi-tenant environments where untrusted containers run alongside sensitive workloads.

• CVE-2026-53489MEDIUM 6.5

  A vulnerability in containerd, the widely-used container runtime powering Kubernetes and Docker environments, allows an authenticated user to read arbitrary files on the host system. The flaw exists in how the CRI plugin (Container Runtime Interface) handles container logs when restoring from checkpoint images—it fails to validate symlink paths, enabling an attacker to redirect log requests to sensitive files elsewhere on the system. An attacker with local access or pod-level permissions could exploit this via kubectl logs commands to extract confidential data. The issue affects containerd versions prior to 2.3.2, 2.2.5, and 2.1.9.

• CVE-2026-13748MEDIUM 6.3

  Snowflake CLI versions before 3.19 contain a path traversal flaw that allows attackers to read arbitrary files from the local system. If an attacker can trick a user into processing malicious project or repository content, the CLI will read files outside the intended project directory and send their contents to Snowflake services. The attacker would then need to access the victim's Snowflake account—such as through query history or uploaded files—to retrieve the exfiltrated data. This requires user interaction and depends on the attacker having follow-on access to the Snowflake environment.

• CVE-2025-43278MEDIUM 5.5

  CVE-2025-43278 is a local privilege escalation vulnerability in macOS Sequoia that allows an application to access protected user data through improper symlink handling. An attacker with local access and user interaction can exploit this to read sensitive files that should be restricted. The vulnerability requires the user to take an action (such as opening a file or interacting with an app), but does not require administrator privileges. Apple has addressed this in macOS Sequoia 15.4 with improved symlink validation logic.

• CVE-2026-55686MEDIUM 5.3

  Podman, a widely-used container management tool, contains a symlink-handling vulnerability that allows a malicious container image to create directories or modify file ownership on the host system. The flaw exists in versions 3.0.0 through 5.7.0 and has been patched in version 5.7.1. An attacker would need to craft a container with a symlink in the WORKDIR path; modifying ownership requires additional coordination with a compromised host process during a race condition window, making that outcome less probable but still possible.

• CVE-2026-13218MEDIUM 4.2

  KubeVirt's virt-handler component contains a symlink-following vulnerability in its network cache handling. When virt-handler writes cached network configuration files, it does not validate whether the target path is a symlink. An attacker with access to a virt-launcher container can plant a symlink at the expected cache file location, tricking virt-handler into overwriting an arbitrary file on the host system and changing its ownership. This is a local privilege escalation vector that requires container-level access to exploit but can impact the integrity of host system files.

• CVE-2026-14699LOW 3.3

  CVE-2026-14699 is a local symlink-following vulnerability in markdownify-mcp, a Markdown conversion tool. An attacker with local access and low-level privileges can manipulate file paths to cause the application to follow symbolic links, potentially reading files outside the intended directory. The risk is contained because exploitation requires direct local access and low-privilege user status.

• CVE-2026-41579LOW 3.3

  runc, the container runtime tool used by Docker and other container platforms, contains a vulnerability in how it sets up container filesystems. A malicious container image can exploit this by making /dev a symlink, causing runc to delete or create files in unexpected locations on the host system. Docker users are protected because Docker adds a read-only layer that blocks this attack, but other container tools built on runc may remain vulnerable if they don't have similar protections. The issue affects versions before 1.3.6, 1.4.3, and 1.5.0.