Common Weakness Enumeration
CWE-59
AllowedImproper Link Resolution Before File Access ('Link Following')
Abstraction: Base · Status: Draft
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
860 vulnerabilities reference this CWE, most recent first.
CVE-2026-108723 (GCVE-0-2026-108723)
Vulnerability from cvelistv5 – Published: 2026-10-11 12:19 – Updated: 2026-10-18 11:53
VLAI
EPSS
VEX
Title
answer-me-with-html through 0.5.0 Symlink Following in Code Block src Embedding
Summary
answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without resolving symlinks. Attackers can ship a repository with a symlink pointing outside the checkout so am render embeds readable external files into generated HTML, disclosing them when shared.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:31 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
VulnCheck
CNA
References
4 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind/answer-me-with-html-code… | third-party-advisory |
| https://github.com/QingYunA/answer-me-with-html/b… | technical-description |
| https://github.com/QingYunA/answer-me-with-html | product |
| https://www.vulncheck.com/advisories/answer-me-wi… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| QingYunA | answer-me-with-html |
Affected:
0 , ≤ 0.5.0
(semver)
|
Date Public
2026-10-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108723",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:31:05.902831Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:53:06.818Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/QingYunA/answer-me-with-html",
"product": "answer-me-with-html",
"repo": "https://github.com/QingYunA/answer-me-with-html",
"vendor": "QingYunA",
"versions": [
{
"lessThanOrEqual": "0.5.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without resolving symlinks. Attackers can ship a repository with a symlink pointing outside the checkout so am render embeds readable external files into generated HTML, disclosing them when shared."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 2,
"baseSeverity": "LOW",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.5,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-11T12:19:33.297Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haind/answer-me-with-html-code-src-symlink-escape"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/QingYunA/answer-me-with-html/blob/b275eba8d4cc49bcb4bbc28459863f4b49a480f9/src/code.js#L74-L105"
},
{
"tags": [
"product"
],
"url": "https://github.com/QingYunA/answer-me-with-html"
},
{
"name": "VulnCheck Advisory: answer-me-with-html through 0.5.0 Symlink Following in Code Block src Embedding",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/answer-me-with-html-through-0.5.0-symlink-following-in-code-block-src-embedding"
}
],
"title": "answer-me-with-html through 0.5.0 Symlink Following in Code Block src Embedding",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-108723",
"datePublished": "2026-10-11T12:19:33.297Z",
"dateReserved": "2026-10-11T01:52:33.088Z",
"dateUpdated": "2026-10-18T11:53:06.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108600 (GCVE-0-2026-108600)
Vulnerability from cvelistv5 – Published: 2026-10-10 18:58 – Updated: 2026-10-13 18:54
VLAI
EPSS
VEX
Title
open-multi-agent 1.5.0 through 1.21.2 Sandbox Escape via file_write Dangling Symlink
Summary
open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that allows attackers to create files outside the workspace root by using dangling symlinks. Attackers can plant a dangling symlink in the workspace and steer the agent via prompt injection to write attacker-influenced content anywhere the agent process can write.
Severity
4.7 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 18:54 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind/open-multi-agent-file-wr… | third-party-advisory |
| https://github.com/open-multi-agent/open-multi-ag… | technical-description |
| https://github.com/open-multi-agent/open-multi-ag… | technical-description |
| https://github.com/open-multi-agent/open-multi-agent | product |
| https://www.vulncheck.com/advisories/open-multi-a… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| open-multi-agent | open-multi-agent |
Affected:
1.5.0 , ≤ 1.21.2
(semver)
|
Date Public
2026-10-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108600",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T18:54:28.947812Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:54:52.634Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@haind/open-multi-agent-file-write-dangling-symlink-escape"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.npmjs.com",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/%40open-multi-agent/core",
"product": "open-multi-agent",
"repo": "https://github.com/open-multi-agent/open-multi-agent",
"vendor": "open-multi-agent",
"versions": [
{
"lessThanOrEqual": "1.21.2",
"status": "affected",
"version": "1.5.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that allows attackers to create files outside the workspace root by using dangling symlinks. Attackers can plant a dangling symlink in the workspace and steer the agent via prompt injection to write attacker-influenced content anywhere the agent process can write."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T18:58:16.432Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haind/open-multi-agent-file-write-dangling-symlink-escape"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/open-multi-agent/open-multi-agent/blob/6ec5498643c7e431aa66751f17f47a529e7f927c/packages/core/src/tool/built-in/path-safety.ts#L104-L113"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/open-multi-agent/open-multi-agent/blob/6ec5498643c7e431aa66751f17f47a529e7f927c/packages/core/src/tool/built-in/file-write.ts#L67"
},
{
"tags": [
"product"
],
"url": "https://github.com/open-multi-agent/open-multi-agent"
},
{
"name": "VulnCheck Advisory: open-multi-agent 1.5.0 through 1.21.2 Sandbox Escape via file_write Dangling Symlink",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/open-multi-agent-1.5.0-through-1.21.2-sandbox-escape-via-file-write-dangling-symlink"
}
],
"title": "open-multi-agent 1.5.0 through 1.21.2 Sandbox Escape via file_write Dangling Symlink",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-108600",
"datePublished": "2026-10-10T18:58:16.432Z",
"dateReserved": "2026-10-10T18:25:15.230Z",
"dateUpdated": "2026-10-13T18:54:52.634Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108599 (GCVE-0-2026-108599)
Vulnerability from cvelistv5 – Published: 2026-10-10 18:58 – Updated: 2026-10-14 16:02
VLAI
EPSS
VEX
Title
Phi 0.1.1 through 0.28.4 Symlink Workspace Write Restriction Bypass
Summary
phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only path checks in the permission gate. Attackers can commit symlinks pointing outside the workspace and use prompt injection to make the write tool write attacker-influenced content to external files without approval.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 14:50 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
VulnCheck
CNA
References
5 references
| URL | Tags |
|---|---|
| https://hackmd.io/@haind/phi-symlink-permission-b… | third-party-advisory |
| https://github.com/pulseaiclub/phi/blob/5b3cb440a… | technical-description |
| https://github.com/pulseaiclub/phi/blob/5b3cb440a… | technical-description |
| https://github.com/pulseaiclub/phi | product |
| https://www.vulncheck.com/advisories/phi-0.1.1-th… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| pulseaiclub | phi |
Affected:
0.1.1 , ≤ 0.28.4
(semver)
|
Date Public
2026-10-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108599",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T14:50:10.495315Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T16:02:53.639Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/pulseaiclub/phi",
"product": "phi",
"repo": "https://github.com/pulseaiclub/phi",
"vendor": "pulseaiclub",
"versions": [
{
"lessThanOrEqual": "0.28.4",
"status": "affected",
"version": "0.1.1",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "HaiND from the Post and Telecommunication Institute of Technology"
}
],
"datePublic": "2026-10-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only path checks in the permission gate. Attackers can commit symlinks pointing outside the workspace and use prompt injection to make the write tool write attacker-influenced content to external files without approval."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 5.7,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-10T18:58:15.610Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@haind/phi-symlink-permission-boundary"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pulseaiclub/phi/blob/5b3cb440a7c58115ef64283a737a43299f2805a4/internal/permission/gate.go#L106-L119"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/pulseaiclub/phi/blob/5b3cb440a7c58115ef64283a737a43299f2805a4/internal/tools/writetool/write.go#L64-L68"
},
{
"tags": [
"product"
],
"url": "https://github.com/pulseaiclub/phi"
},
{
"name": "VulnCheck Advisory: Phi 0.1.1 through 0.28.4 Symlink Workspace Write Restriction Bypass",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/phi-0.1.1-through-0.28.4-symlink-workspace-write-restriction-bypass"
}
],
"title": "Phi 0.1.1 through 0.28.4 Symlink Workspace Write Restriction Bypass",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-108599",
"datePublished": "2026-10-10T18:58:15.610Z",
"dateReserved": "2026-10-10T18:25:14.879Z",
"dateUpdated": "2026-10-14T16:02:53.639Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108332 (GCVE-0-2026-108332)
Vulnerability from cvelistv5 – Published: 2026-10-27 17:35 – Updated: 2026-11-04 20:21
VLAI
EPSS
VEX
Title
Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.
Summary
Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:06 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
Tanium
CNA
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | Endpoint Configuration Toolset Solution |
Affected:
1.51.0 , < 1.51.60
(custom)
Affected: 1.59.0 , < 1.59.50 (custom) Affected: 1.71.0 , < 1.71.25 (custom) |
|
| Tanium | threat-response-cx |
Affected:
1.17.802 , < 1.17.802
(semver)
Affected: 1.18.2732 , < 1.18.2732 (semver) Affected: 1.19.2213 , < 1.19.2213 (semver) Affected: 1.20.2271 , < 1.20.2271 (semver) Affected: 1.21.1673 , < 1.21.1673 (semver) |
Date Public
2026-10-27 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108332",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:06:13.427552Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:21:44.226Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Endpoint Configuration Toolset Solution",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.51.60",
"status": "affected",
"version": "1.51.0",
"versionType": "custom"
},
{
"lessThan": "1.59.50",
"status": "affected",
"version": "1.59.0",
"versionType": "custom"
},
{
"lessThan": "1.71.25",
"status": "affected",
"version": "1.71.0",
"versionType": "custom"
}
]
},
{
"product": "threat-response-cx",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.17.802",
"status": "affected",
"version": "1.17.802",
"versionType": "semver"
},
{
"lessThan": "1.18.2732",
"status": "affected",
"version": "1.18.2732",
"versionType": "semver"
},
{
"lessThan": "1.19.2213",
"status": "affected",
"version": "1.19.2213",
"versionType": "semver"
},
{
"lessThan": "1.20.2271",
"status": "affected",
"version": "1.20.2271",
"versionType": "semver"
},
{
"lessThan": "1.21.1673",
"status": "affected",
"version": "1.21.1673",
"versionType": "semver"
}
]
}
],
"dateAssigned": "2026-10-09T19:21:34.683Z",
"datePublic": "2026-10-27T17:26:16.663Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:35:41.790Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-055",
"url": "https://security.tanium.com/TAN-2026-055"
}
],
"title": "Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-108332",
"datePublished": "2026-10-27T17:35:41.790Z",
"dateReserved": "2026-10-09T19:21:34.846Z",
"dateUpdated": "2026-11-04T20:21:44.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108306 (GCVE-0-2026-108306)
Vulnerability from cvelistv5 – Published: 2026-10-27 17:35 – Updated: 2026-11-04 20:21
VLAI
EPSS
VEX
Title
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
Summary
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:06 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
Tanium
CNA
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | Endpoint Configuration Toolset Solution |
Affected:
1.51 , < 1.51.60
(custom)
Affected: 1.59 , < 1.59.50 (custom) Affected: 1.71 , < 1.71.25 (custom) |
|
| Tanium | end-user-cx |
Affected:
1.8.47 , < 1.8.47
(semver)
Affected: 1.11.605 , < 1.11.605 (semver) Affected: 1.19.325 , < 1.19.325 (semver) Affected: 1.21.835 , < 1.21.835 (semver) Affected: 1.22.1199 , < 1.22.1199 (semver) Affected: 1.23.766 , < 1.23.766 (semver) Affected: 1.24.590 , < 1.24.590 (semver) |
Date Public
2026-10-27 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108306",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:06:16.233737Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:21:31.312Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Endpoint Configuration Toolset Solution",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.51.60",
"status": "affected",
"version": "1.51",
"versionType": "custom"
},
{
"lessThan": "1.59.50",
"status": "affected",
"version": "1.59",
"versionType": "custom"
},
{
"lessThan": "1.71.25",
"status": "affected",
"version": "1.71",
"versionType": "custom"
}
]
},
{
"product": "end-user-cx",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.8.47",
"status": "affected",
"version": "1.8.47",
"versionType": "semver"
},
{
"lessThan": "1.11.605",
"status": "affected",
"version": "1.11.605",
"versionType": "semver"
},
{
"lessThan": "1.19.325",
"status": "affected",
"version": "1.19.325",
"versionType": "semver"
},
{
"lessThan": "1.21.835",
"status": "affected",
"version": "1.21.835",
"versionType": "semver"
},
{
"lessThan": "1.22.1199",
"status": "affected",
"version": "1.22.1199",
"versionType": "semver"
},
{
"lessThan": "1.23.766",
"status": "affected",
"version": "1.23.766",
"versionType": "semver"
},
{
"lessThan": "1.24.590",
"status": "affected",
"version": "1.24.590",
"versionType": "semver"
}
]
}
],
"dateAssigned": "2026-10-09T19:21:25.468Z",
"datePublic": "2026-10-27T17:26:19.759Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed a local privilege escalation vulnerability in End-User Notifications."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:35:42.154Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-065",
"url": "https://security.tanium.com/TAN-2026-065"
}
],
"title": "Tanium addressed a local privilege escalation vulnerability in End-User Notifications."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-108306",
"datePublished": "2026-10-27T17:35:42.154Z",
"dateReserved": "2026-10-09T19:21:25.635Z",
"dateUpdated": "2026-11-04T20:21:31.312Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108305 (GCVE-0-2026-108305)
Vulnerability from cvelistv5 – Published: 2026-10-27 17:33 – Updated: 2026-11-04 20:23
VLAI
EPSS
VEX
Title
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
Summary
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:06 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
Tanium
CNA
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | Endpoint Configuration Toolset Solution |
Affected:
1.51 , < 1.51.60
(custom)
Affected: 1.59 , < 1.59.50 (custom) Affected: 1.71 , < 1.71.25 (custom) |
|
| Tanium | end-user-cx |
Affected:
1.8.47 , < 1.8.47
(semver)
Affected: 1.11.605 , < 1.11.605 (semver) Affected: 1.19.325 , < 1.19.325 (semver) Affected: 1.21.835 , < 1.21.835 (semver) Affected: 1.22.1199 , < 1.22.1199 (semver) Affected: 1.23.766 , < 1.23.766 (semver) Affected: 1.24.590 , < 1.24.590 (semver) |
Date Public
2026-10-27 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108305",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T20:06:10.591256Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:23:00.839Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Endpoint Configuration Toolset Solution",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.51.60",
"status": "affected",
"version": "1.51",
"versionType": "custom"
},
{
"lessThan": "1.59.50",
"status": "affected",
"version": "1.59",
"versionType": "custom"
},
{
"lessThan": "1.71.25",
"status": "affected",
"version": "1.71",
"versionType": "custom"
}
]
},
{
"product": "end-user-cx",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.8.47",
"status": "affected",
"version": "1.8.47",
"versionType": "semver"
},
{
"lessThan": "1.11.605",
"status": "affected",
"version": "1.11.605",
"versionType": "semver"
},
{
"lessThan": "1.19.325",
"status": "affected",
"version": "1.19.325",
"versionType": "semver"
},
{
"lessThan": "1.21.835",
"status": "affected",
"version": "1.21.835",
"versionType": "semver"
},
{
"lessThan": "1.22.1199",
"status": "affected",
"version": "1.22.1199",
"versionType": "semver"
},
{
"lessThan": "1.23.766",
"status": "affected",
"version": "1.23.766",
"versionType": "semver"
},
{
"lessThan": "1.24.590",
"status": "affected",
"version": "1.24.590",
"versionType": "semver"
}
]
}
],
"dateAssigned": "2026-10-09T19:21:25.115Z",
"datePublic": "2026-10-27T17:26:18.366Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed a local privilege escalation vulnerability in End-User Notifications."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:33:33.369Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-061",
"url": "https://security.tanium.com/TAN-2026-061"
}
],
"title": "Tanium addressed a local privilege escalation vulnerability in End-User Notifications."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-108305",
"datePublished": "2026-10-27T17:33:33.369Z",
"dateReserved": "2026-10-09T19:21:25.285Z",
"dateUpdated": "2026-11-04T20:23:00.839Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108304 (GCVE-0-2026-108304)
Vulnerability from cvelistv5 – Published: 2026-10-27 17:35 – Updated: 2026-11-04 17:35
VLAI
EPSS
VEX
Title
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
Summary
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 17:34 UTC
CWE
Assigner
Tanium
CNA
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | Endpoint Configuration Toolset Solution |
Affected:
1.51 , < 1.51.60
(custom)
Affected: 1.59 , < 1.59.50 (custom) Affected: 1.71 , < 1.71.25 (custom) |
|
| Tanium | end-user-cx |
Affected:
1.8.47 , < 1.8.47
(semver)
Affected: 1.11.605 , < 1.11.605 (semver) Affected: 1.19.325 , < 1.19.325 (semver) Affected: 1.21.835 , < 1.21.835 (semver) Affected: 1.22.1199 , < 1.22.1199 (semver) Affected: 1.23.766 , < 1.23.766 (semver) Affected: 1.24.590 , < 1.24.590 (semver) |
Date Public
2026-10-27 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108304",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T17:34:55.798269Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T17:35:45.378Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Endpoint Configuration Toolset Solution",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.51.60",
"status": "affected",
"version": "1.51",
"versionType": "custom"
},
{
"lessThan": "1.59.50",
"status": "affected",
"version": "1.59",
"versionType": "custom"
},
{
"lessThan": "1.71.25",
"status": "affected",
"version": "1.71",
"versionType": "custom"
}
]
},
{
"product": "end-user-cx",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.8.47",
"status": "affected",
"version": "1.8.47",
"versionType": "semver"
},
{
"lessThan": "1.11.605",
"status": "affected",
"version": "1.11.605",
"versionType": "semver"
},
{
"lessThan": "1.19.325",
"status": "affected",
"version": "1.19.325",
"versionType": "semver"
},
{
"lessThan": "1.21.835",
"status": "affected",
"version": "1.21.835",
"versionType": "semver"
},
{
"lessThan": "1.22.1199",
"status": "affected",
"version": "1.22.1199",
"versionType": "semver"
},
{
"lessThan": "1.23.766",
"status": "affected",
"version": "1.23.766",
"versionType": "semver"
},
{
"lessThan": "1.24.590",
"status": "affected",
"version": "1.24.590",
"versionType": "semver"
}
]
}
],
"dateAssigned": "2026-10-09T19:21:24.751Z",
"datePublic": "2026-10-27T17:26:17.500Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed a local privilege escalation vulnerability in End-User Notifications."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-282",
"description": "Improper Ownership Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:35:24.064Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-058",
"url": "https://security.tanium.com/TAN-2026-058"
}
],
"title": "Tanium addressed a local privilege escalation vulnerability in End-User Notifications."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-108304",
"datePublished": "2026-10-27T17:35:24.064Z",
"dateReserved": "2026-10-09T19:21:24.929Z",
"dateUpdated": "2026-11-04T17:35:45.378Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108262 (GCVE-0-2026-108262)
Vulnerability from cvelistv5 – Published: 2026-11-06 18:29 – Updated: 2026-11-06 18:29
VLAI
EPSS
VEX
Title
DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885
Summary
DDEV is an open-source tool for running local web development environments for PHP and Node.js. From 1.25.2 until 1.25.4, Untar in pkg/archive/archive.go validates an absolute tar symlink target after rebasing it beneath dest, but creates the symlink with the raw absolute Linkname. A crafted archive can therefore plant a host-absolute symlink and use a following regular-file entry to write outside the extraction directory. The flaw is reachable through remote add-on retrieval and database or file imports, and overwriting shell startup files, Git hooks, or cron entries can lead to code execution in the DDEV user's context. Unzip is not affected. This issue is fixed in version 1.25.4.
Severity
6.5 (Medium)
CWE
Assigner
GitHub_M
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/ddev/ddev/security/advisories/… | x_refsource_CONFIRM |
{
"containers": {
"cna": {
"affected": [
{
"product": "ddev",
"vendor": "ddev",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.25.2, \u003c 1.25.4"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "DDEV is an open-source tool for running local web development environments for PHP and Node.js. From 1.25.2 until 1.25.4, Untar in pkg/archive/archive.go validates an absolute tar symlink target after rebasing it beneath dest, but creates the symlink with the raw absolute Linkname. A crafted archive can therefore plant a host-absolute symlink and use a following regular-file entry to write outside the extraction directory. The flaw is reachable through remote add-on retrieval and database or file imports, and overwriting shell startup files, Git hooks, or cron entries can lead to code execution in the DDEV user\u0027s context. Unzip is not affected. This issue is fixed in version 1.25.4."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T18:29:49.225Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/ddev/ddev/security/advisories/GHSA-9hq4-hm3j-jmph",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ddev/ddev/security/advisories/GHSA-9hq4-hm3j-jmph"
}
],
"source": {
"advisory": "GHSA-9hq4-hm3j-jmph",
"discovery": "UNKNOWN"
},
"title": "DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-108262",
"datePublished": "2026-11-06T18:29:49.225Z",
"dateReserved": "2026-10-09T17:33:15.410Z",
"dateUpdated": "2026-11-06T18:29:49.225Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108135 (GCVE-0-2026-108135)
Vulnerability from cvelistv5 – Published: 2026-10-13 19:01 – Updated: 2026-10-31 18:13
VLAI
EPSS
VEX
Title
Windows Backup Engine Elevation of Privilege Vulnerability
Summary
Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 00:00 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
microsoft
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Windows 10 Version 21H2 |
Affected:
10.0.19044.0 , < 10.0.19044.7807
(custom)
|
|
| Microsoft | Windows 10 Version 22H2 |
Affected:
10.0.19045.0 , < 10.0.19045.7807
(custom)
|
|
| Microsoft | Windows 11 version 23H2 |
Affected:
10.0.22631.0 , < 10.0.22631.7652
(custom)
|
|
| Microsoft | Windows 11 Version 23H2 |
Affected:
10.0.22631.0 , < 10.0.22631.7652
(custom)
|
|
| Microsoft | Windows 11 Version 24H2 |
Affected:
10.0.26100.0 , < 10.0.26100.9711
(custom)
|
|
| Microsoft | Windows 11 Version 25H2 |
Affected:
10.0.26200.0 , < 10.0.26200.9711
(custom)
|
|
| Microsoft | Windows 11 version 26H1 |
Affected:
10.0.28000.0 , < 10.0.28000.3231
(custom)
|
|
| Microsoft | Windows 11 Version 26H2 |
Affected:
10.0.26300.0 , < 10.0.26300.9711
(custom)
|
Date Public
2026-10-13 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108135",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T03:57:17.839Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"ARM64-based Systems",
"x64-based Systems"
],
"product": "Windows 10 Version 21H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.19044.7807",
"status": "affected",
"version": "10.0.19044.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"ARM64-based Systems",
"x64-based Systems"
],
"product": "Windows 10 Version 22H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.19045.7807",
"status": "affected",
"version": "10.0.19045.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"ARM64-based Systems"
],
"product": "Windows 11 version 23H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.22631.7652",
"status": "affected",
"version": "10.0.22631.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows 11 Version 23H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.22631.7652",
"status": "affected",
"version": "10.0.22631.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
],
"product": "Windows 11 Version 24H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.26100.9711",
"status": "affected",
"version": "10.0.26100.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
],
"product": "Windows 11 Version 25H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.26200.9711",
"status": "affected",
"version": "10.0.26200.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
],
"product": "Windows 11 version 26H1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.28000.3231",
"status": "affected",
"version": "10.0.28000.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
],
"product": "Windows 11 Version 26H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.26300.9711",
"status": "affected",
"version": "10.0.26300.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:*",
"versionEndExcluding": "10.0.19044.7807",
"versionStartIncluding": "10.0.19044.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x86:*",
"versionEndExcluding": "10.0.19045.7807",
"versionStartIncluding": "10.0.19045.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:arm64:*",
"versionEndExcluding": "10.0.22631.7652",
"versionStartIncluding": "10.0.22631.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "10.0.22631.7652",
"versionStartIncluding": "10.0.22631.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*",
"versionEndExcluding": "10.0.26100.9711",
"versionStartIncluding": "10.0.26100.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*",
"versionEndExcluding": "10.0.26200.9711",
"versionStartIncluding": "10.0.26200.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:windows_11_version_26h2_for_arm64-based_systems:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.26300.9711",
"versionStartIncluding": "10.0.26300.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:arm64:*",
"versionEndExcluding": "10.0.28000.3231",
"versionStartIncluding": "10.0.28000.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-13T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "Improper link resolution before file access (\u0027link following\u0027) in Windows Backup Engine allows an authorized attacker to elevate privileges locally."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:28.427Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Windows Backup Engine Elevation of Privilege Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108135"
}
],
"title": "Windows Backup Engine Elevation of Privilege Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108135",
"datePublished": "2026-10-13T19:01:45.274Z",
"dateReserved": "2026-10-09T14:51:03.495Z",
"dateUpdated": "2026-10-31T18:13:28.427Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108119 (GCVE-0-2026-108119)
Vulnerability from cvelistv5 – Published: 2026-10-09 16:45 – Updated: 2026-11-05 15:56
VLAI
EPSS
VEX
Title
Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix
Summary
A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive using a symlink target of exactly '..' combined with a deferred hardlink to create a new file outside the extraction directory, or reuse an extraction directory across two archives to replace an existing file outside it. If the archive is extracted with elevated privileges, this flaw can lead to privilege escalation or arbitrary code execution.
Severity
6.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 16:59 UTC
CWE
- CWE-59 - Improper Link Resolution Before File Access
Assigner
redhat
CNA
References
3 references
| URL | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:81391 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/security/cve/CVE-2026-108119 | vdb-entryx_refsource_REDHAT |
| https://bugzilla.redhat.com/show_bug.cgi?id=2548611 | issue-trackingx_refsource_REDHAT |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Red Hat | Red Hat Hardened Images |
Unaffected:
1.37.0-9.4.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
|
| Red Hat | Red Hat Enterprise Linux 6 |
cpe:/o:redhat:rhel_els:6
|
Date Public
2026-10-09 15:31
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108119",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T16:59:08.220810Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T16:59:20.957Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "busybox-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1.37.0-9.4.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:rhel_els:6"
],
"defaultStatus": "affected",
"packageName": "busybox",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank TAE3 for reporting this issue."
}
],
"datePublic": "2026-10-09T15:31:42.723Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in busybox. The tar applet\u0027s deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets does not validate that the resolved destination remains inside the extraction directory once the deferred link is created. An attacker can craft a tar archive using a symlink target of exactly \u0027..\u0027 combined with a deferred hardlink to create a new file outside the extraction directory, or reuse an extraction directory across two archives to replace an existing file outside it. If the archive is extracted with elevated privileges, this flaw can lead to privilege escalation or arbitrary code execution."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-59",
"description": "Improper Link Resolution Before File Access",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T15:56:00.857Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2026:81391",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:81391"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-108119"
},
{
"name": "RHBZ#2548611",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2548611"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-09T14:03:56.635Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-10-09T15:31:42.723Z",
"value": "Made public."
}
],
"title": "Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix",
"workarounds": [
{
"lang": "en",
"value": "Avoid extracting tar archives from untrusted sources using busybox, especially with elevated privileges or into a directory that will be reused for a subsequent extraction. If untrusted archives must be processed, extract into a freshly created, isolated directory with minimal privileges on a single filesystem boundary and discard it (including any links left on disk) after each extraction."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2026-108119",
"datePublished": "2026-10-09T16:45:59.735Z",
"dateReserved": "2026-10-09T14:09:13.658Z",
"dateUpdated": "2026-11-05T15:56:00.857Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-48.1
Architecture and Design
Strategy: Separation of Privilege
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack
An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.