Common Weakness Enumeration
CWE-62
AllowedUNIX Hard Link
Abstraction: Variant · Status: Incomplete
The product, when opening a file or directory, does not sufficiently account for when the name is associated with a hard link to a target that is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
5 vulnerabilities reference this CWE, most recent first.
CVE-2026-112934 (GCVE-0-2026-112934)
Vulnerability from cvelistv5 – Published: 2026-10-20 14:30 – Updated: 2026-10-22 21:28
VLAI
EPSS
VEX
Title
filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record
Summary
filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link policy to link a reachable target file and cause the lock user to write through it. This issue is fixed in version 4.2.1.
Severity
6.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-22 21:28 UTC
CWE
- CWE-62 - UNIX Hard Link
Assigner
GitHub_M
CNA
References
4 references
| URL | Tags |
|---|---|
| https://github.com/tox-dev/filelock/security/advi… | x_refsource_CONFIRM |
| https://github.com/tox-dev/filelock/pull/842 | x_refsource_MISC |
| https://github.com/tox-dev/filelock/commit/bfa066… | x_refsource_MISC |
| https://github.com/tox-dev/filelock/releases/tag/4.2.1 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112934",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-22T21:28:05.808470Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-22T21:28:27.242Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/tox-dev/filelock/security/advisories/GHSA-fj95-fr6c-h845"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "filelock",
"vendor": "tox-dev",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.0.0, \u003c 4.2.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowing another local user with rename access to the lock directory to replace a record with a named pipe and stall the lock, or under a permissive hard-link policy to link a reachable target file and cause the lock user to write through it. This issue is fixed in version 4.2.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-62",
"description": "CWE-62: UNIX Hard Link",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T14:30:43.736Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tox-dev/filelock/security/advisories/GHSA-fj95-fr6c-h845",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tox-dev/filelock/security/advisories/GHSA-fj95-fr6c-h845"
},
{
"name": "https://github.com/tox-dev/filelock/pull/842",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tox-dev/filelock/pull/842"
},
{
"name": "https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tox-dev/filelock/commit/bfa066d65a1ba9106f86ee9d027f7588b9c77e03"
},
{
"name": "https://github.com/tox-dev/filelock/releases/tag/4.2.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tox-dev/filelock/releases/tag/4.2.1"
}
],
"source": {
"advisory": "GHSA-fj95-fr6c-h845",
"discovery": "UNKNOWN"
},
"title": "filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-112934",
"datePublished": "2026-10-20T14:30:43.736Z",
"dateReserved": "2026-10-19T21:30:47.244Z",
"dateUpdated": "2026-10-22T21:28:27.242Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109518 (GCVE-0-2026-109518)
Vulnerability from cvelistv5 – Published: 2026-11-04 15:49 – Updated: 2026-11-05 04:56
VLAI
EPSS
VEX
Title
APT RCE via hard link reuse
Summary
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.
The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 00:00 UTC
Assigner
canonical
CNA
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Debian | APT |
Affected:
0 , < 1.2.36
(dpkg)
Affected: 1.4.0 , < 1.4.12 (dpkg) Affected: 1.6.0 , < 1.6.19 (dpkg) Affected: 1.8.0 , < 1.8.2.4 (dpkg) Affected: 1.8.3 , ≤ 1.8.5 (dpkg) Affected: 2.0.0 , < 2.0.12 (dpkg) Affected: 2.2.0 , < 2.2.5 (dpkg) Affected: 2.4.0 , < 2.4.15 (dpkg) Affected: 2.6.0 , < 2.6.2 (dpkg) Affected: 2.8.0 , < 2.8.4 (dpkg) Affected: 3.0.0 , < 3.0.4 (dpkg) Affected: 3.2.0 , < 3.2.1 (dpkg) Affected: 3.3.0 , < 3.3.6 (dpkg) |
|
| Ubuntu | APT |
Affected:
0 , < 1.0.1ubuntu2.24+esm4
(dpkg)
Affected: 1.2.0 , < 1.2.36+esm1 (dpkg) Affected: 1.6.0 , < 1.6.19+esm1 (dpkg) Affected: 2.0.0 , < 2.0.12+esm1 (dpkg) Affected: 2.4.0 , < 2.4.15ubuntu0.1 (dpkg) Affected: 2.8.0 , < 2.8.4ubuntu0.1 (dpkg) Affected: 3.2.0 , < 3.2.1ubuntu0.1 (dpkg) Affected: 3.3.0 , < 3.3.3ubuntu0.1 (dpkg) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-11-05T00:12:15.622Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/11/04/12"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109518",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T04:56:46.536Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageName": "apt",
"product": "APT",
"vendor": "Debian",
"versions": [
{
"lessThan": "1.2.36",
"status": "affected",
"version": "0",
"versionType": "dpkg"
},
{
"lessThan": "1.4.12",
"status": "affected",
"version": "1.4.0",
"versionType": "dpkg"
},
{
"lessThan": "1.6.19",
"status": "affected",
"version": "1.6.0",
"versionType": "dpkg"
},
{
"lessThan": "1.8.2.4",
"status": "affected",
"version": "1.8.0",
"versionType": "dpkg"
},
{
"lessThanOrEqual": "1.8.5",
"status": "affected",
"version": "1.8.3",
"versionType": "dpkg"
},
{
"lessThan": "2.0.12",
"status": "affected",
"version": "2.0.0",
"versionType": "dpkg"
},
{
"lessThan": "2.2.5",
"status": "affected",
"version": "2.2.0",
"versionType": "dpkg"
},
{
"lessThan": "2.4.15",
"status": "affected",
"version": "2.4.0",
"versionType": "dpkg"
},
{
"lessThan": "2.6.2",
"status": "affected",
"version": "2.6.0",
"versionType": "dpkg"
},
{
"lessThan": "2.8.4",
"status": "affected",
"version": "2.8.0",
"versionType": "dpkg"
},
{
"lessThan": "3.0.4",
"status": "affected",
"version": "3.0.0",
"versionType": "dpkg"
},
{
"lessThan": "3.2.1",
"status": "affected",
"version": "3.2.0",
"versionType": "dpkg"
},
{
"lessThan": "3.3.6",
"status": "affected",
"version": "3.3.0",
"versionType": "dpkg"
}
]
},
{
"defaultStatus": "unaffected",
"packageName": "apt",
"product": "APT",
"vendor": "Ubuntu",
"versions": [
{
"lessThan": "1.0.1ubuntu2.24+esm4",
"status": "affected",
"version": "0",
"versionType": "dpkg"
},
{
"lessThan": "1.2.36+esm1",
"status": "affected",
"version": "1.2.0",
"versionType": "dpkg"
},
{
"lessThan": "1.6.19+esm1",
"status": "affected",
"version": "1.6.0",
"versionType": "dpkg"
},
{
"lessThan": "2.0.12+esm1",
"status": "affected",
"version": "2.0.0",
"versionType": "dpkg"
},
{
"lessThan": "2.4.15ubuntu0.1",
"status": "affected",
"version": "2.4.0",
"versionType": "dpkg"
},
{
"lessThan": "2.8.4ubuntu0.1",
"status": "affected",
"version": "2.8.0",
"versionType": "dpkg"
},
{
"lessThan": "3.2.1ubuntu0.1",
"status": "affected",
"version": "3.2.0",
"versionType": "dpkg"
},
{
"lessThan": "3.3.3ubuntu0.1",
"status": "affected",
"version": "3.3.0",
"versionType": "dpkg"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Max Justicz"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Julian Andres Klode"
}
],
"descriptions": [
{
"lang": "en",
"value": "On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero\u00a0Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration"
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-62",
"description": "CWE-62 UNIX hard link",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T15:49:02.951Z",
"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"shortName": "canonical"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.debian.org/debian-security-announce/2026/msg00526.html"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://ubuntu.com/security/notices/USN-8996-1"
}
],
"title": "APT RCE via hard link reuse",
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc",
"assignerShortName": "canonical",
"cveId": "CVE-2026-109518",
"datePublished": "2026-11-04T15:49:02.951Z",
"dateReserved": "2026-10-12T18:44:13.619Z",
"dateUpdated": "2026-11-05T04:56:46.536Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-32232 (GCVE-0-2026-32232)
Vulnerability from cvelistv5 – Published: 2026-03-12 18:24 – Updated: 2026-03-12 20:46
VLAI
EPSS
VEX
Title
ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink
Summary
ZeptoClaw is a personal AI assistant. Prior to 0.7.6, there is a Dangling Symlink Component Bypass, TOCTOU Between Validation and Use, and Hardlink Alias Bypass. This vulnerability is fixed in 0.7.6.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-12 20:39 UTC
CWE
Assigner
GitHub_M
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/qhkm/zeptoclaw/security/adviso… | x_refsource_CONFIRM |
| https://github.com/qhkm/zeptoclaw/commit/f50c17e1… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-32232",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-12T20:39:17.690556Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-12T20:46:56.857Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "zeptoclaw",
"vendor": "qhkm",
"versions": [
{
"status": "affected",
"version": "\u003c 0.7.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "ZeptoClaw is a personal AI assistant. Prior to 0.7.6, there is a Dangling Symlink Component Bypass, TOCTOU Between Validation and Use, and Hardlink Alias Bypass. This vulnerability is fixed in 0.7.6."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-62",
"description": "CWE-62: UNIX Hard Link",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-12T18:24:35.225Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/qhkm/zeptoclaw/security/advisories/GHSA-2m67-cxxq-c3h8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/qhkm/zeptoclaw/security/advisories/GHSA-2m67-cxxq-c3h8"
},
{
"name": "https://github.com/qhkm/zeptoclaw/commit/f50c17e11ae3e2d40c96730abac41974ef2ee2a8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/qhkm/zeptoclaw/commit/f50c17e11ae3e2d40c96730abac41974ef2ee2a8"
}
],
"source": {
"advisory": "GHSA-2m67-cxxq-c3h8",
"discovery": "UNKNOWN"
},
"title": "ZeptoClaw: Path boundary checks bypass via symlink, TOCTOU, and hardlink"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-32232",
"datePublished": "2026-03-12T18:24:35.225Z",
"dateReserved": "2026-03-11T14:47:05.683Z",
"dateUpdated": "2026-03-12T20:46:56.857Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-54189 (GCVE-0-2024-54189)
Vulnerability from cvelistv5 – Published: 2025-06-03 09:43 – Updated: 2025-06-03 13:19
VLAI
EPSS
VEX
Summary
A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is taken, a root service writes to a file owned by a normal user. By using a hard link, an attacker can write to an arbitrary file, potentially leading to privilege escalation.
Severity
7.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-03 13:19 UTC
CWE
- CWE-62 - UNIX Hard Link
Assigner
talos
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | Parallels Desktop for Mac |
Affected:
version 20.1.1 (55740)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-06-03T11:03:07.503Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2124"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-54189",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-03T13:19:44.951627Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T13:19:52.966Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2124"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Parallels Desktop for Mac",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "version 20.1.1 (55740)"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by KPC of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is taken, a root service writes to a file owned by a normal user. By using a hard link, an attacker can write to an arbitrary file, potentially leading to privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-62",
"description": "CWE-62: UNIX Hard Link",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T09:43:27.168Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2124",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2124"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2024-54189",
"datePublished": "2025-06-03T09:43:27.168Z",
"dateReserved": "2024-12-05T15:34:29.663Z",
"dateUpdated": "2025-06-03T13:19:52.966Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-36486 (GCVE-0-2024-36486)
Vulnerability from cvelistv5 – Published: 2025-06-03 09:43 – Updated: 2025-06-03 13:22
VLAI
EPSS
VEX
Summary
A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored, the prl_vmarchiver tool decompresses the file and writes the content back to its original location using root privileges. An attacker can exploit this process by using a hard link to write to an arbitrary file, potentially resulting in privilege escalation.
Severity
7.8 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-06-03 13:22 UTC
CWE
- CWE-62 - UNIX Hard Link
Assigner
talos
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Parallels | Parallels Desktop for Mac |
Affected:
version 20.1.1 (55740)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2025-06-03T11:03:05.592Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2126"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-36486",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-03T13:22:10.357632Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T13:22:13.518Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Parallels Desktop for Mac",
"vendor": "Parallels",
"versions": [
{
"status": "affected",
"version": "version 20.1.1 (55740)"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Discovered by KPC of Cisco Talos."
}
],
"descriptions": [
{
"lang": "en",
"value": "A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored, the prl_vmarchiver tool decompresses the file and writes the content back to its original location using root privileges. An attacker can exploit this process by using a hard link to write to an arbitrary file, potentially resulting in privilege escalation."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-62",
"description": "CWE-62: UNIX Hard Link",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-03T09:43:26.596Z",
"orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"shortName": "talos"
},
"references": [
{
"name": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126",
"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-2126"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
"assignerShortName": "talos",
"cveId": "CVE-2024-36486",
"datePublished": "2025-06-03T09:43:26.596Z",
"dateReserved": "2024-12-09T19:55:30.980Z",
"dateUpdated": "2025-06-03T13:22:13.518Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Mitigation MIT-48.1
Architecture and Design
Strategy: Separation of Privilege
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
No CAPEC attack patterns related to this CWE.