Monthly
Authenticated remote attackers holding a valid QuMagie account can exploit a Unix symbolic-link following flaw (CWE-61) in QNAP's QuMagie photo and media management application to compromise the security of the underlying NAS system. The vulnerable code follows attacker-influenced symlinks during file operations, allowing file reads and writes outside the intended media library boundaries, with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflecting high confidentiality, integrity and availability impact that crosses a security scope boundary - essentially escaping the application sandbox to reach the host NAS. Exploitation requires the attacker to first obtain a QuMagie user account (PR:L) and the ability to place a symlink or control a path the app will follow; no victim interaction is needed. There is no public exploit identified at time of analysis, and QNAP has released a fix in QuMagie 2.9.2 and later.
Path traversal in Flatpak's handling of the export/bin directory during application deployment allows a malicious Flatpak app to delete attacker-chosen files outside the deployment directory when that app is installed or upgraded; on system-wide installations the deletions are carried out with root privileges, so a crafted package can remove arbitrary files anywhere the deployer can reach. The flaw affects Flatpak releases before 1.18.4 and is triggered by a user or administrator installing or upgrading an attacker-supplied app, which supplies the required user interaction rather than a network-based trigger; the CVSS vector carries PR:N, so no prior authentication is needed beyond that install action. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation, though the integrity and availability impact is high (arbitrary file deletion) and the flaw crosses a privilege boundary on system-wide installs.
Path traversal in Flatpak's app deployment handling of the exported files/etc directory allows a malicious Flatpak application to empty or replace host files such as /etc/passwd, /etc/group, /etc/machine-id, or /etc/resolv.conf with a symlink when that app is installed or upgraded; on system-wide installations the write is carried out as root. Exploitation is gated on user interaction: the victim must choose to install or upgrade the attacker-supplied app from an untrusted source (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R with high availability and low integrity impact), making this a genuine but moderate-priority integrity/availability issue rather than a critical remote code execution flaw. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Local privilege escalation to root in Flatpak before 1.18.1 lets an unprivileged user holding an active local session abuse the revokefs writer used by flatpak-system-helper: by opening two concurrent revokefs sessions and planting a symlink from one session directory into the other, the attacker retains a file descriptor into a peer session and keeps modifying its files after the system helper has already validated and imported them. The practical payoff is tampering with ostree commit objects in the system repository after signature verification, which translates into root-controlled writes to attacker-chosen paths. Exploitation requires local access and winning a TOCTOU race against the dual-session setup (CVSS AV:L/AC:H/PR:N), and no public exploit code has been identified at time of analysis; the issue is not confirmed as actively exploited (not in CISA KEV).
Sandbox escape in Flatpak before 1.18.1 allows a malicious sandboxed application to gain arbitrary read and write access to host filesystem paths, with direct escalation to code execution outside the sandbox. The root cause is missing symlink validation in Flatpak's app data directory bind-mount logic: attacker-controlled path components (such as the 'tmp' directory under ~/.var/app/APP_ID/cache/) can be replaced with symlinks pointing to arbitrary host locations, which the Linux kernel resolves when bwrap processes the bind-mount. No public exploit has been identified at time of analysis, and this is catalogued as a separate issue from the related CVE-2026-76925.
Symlink following in Dell PowerProtect Cyber Recovery (versions prior to 20.3.0.0) enables a low-privileged local attacker to perform script injection by redirecting privileged file operations through attacker-controlled symbolic links. All three impact dimensions - confidentiality, integrity, availability - are rated High by the vendor, reflecting the potential for full local system compromise on a sensitive data-protection appliance. No public exploit exists and EPSS sits at the 2nd percentile (0.11%), with SSVC confirming no observed active exploitation, indicating limited near-term real-world risk despite the High CVSS score.
Symlink following vulnerability across nine Dell enterprise storage and infrastructure products enables a locally authenticated, low-privileged attacker to elevate their privileges, potentially achieving full system compromise (C:H/I:H/A:H). Affected platforms span Dell AppSync 4.6.0.0, Metro Node 8.0.0, UCC Edge 3.0.1, VxRail 8.0.322, PowerMax 10.3.0, Unity 5.4, PowerFlex Manager 4.5.4, PowerFlex Intelligent Catalog 46.377.00 and 46.382.00, and PowerFlex Rack 4.5.4 and prior. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis, but the breadth of affected Dell enterprise products and the high-impact CVSS metrics make patching a priority for organizations running Dell storage infrastructure.
Arbitrary file read in rsync before 3.5.0 enables attackers with local low-privilege access to read files accessible to the rsync daemon process by exploiting improper symlink resolution in input configuration file handling. The vulnerability affects --files-from, --password-file, and filter merge file paths, allowing placement of a symlink at a predictable argument path or supply of a --files-from path that escapes the daemon module root. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vendor has released a confirmed fix in rsync 3.5.0.
Arbitrary host file write in termux/proot-distro before 5.1.5 lets a malicious rootfs tarball or Docker layer plant an absolute-path symlink during `proot-distro install`, so a follow-up file member is written through that symlink onto the host filesystem - outside the container, before it is ever run. The install/reset paths (_extract_plain_tar) and the Docker layer path (_apply_layer) validated member names for '..' traversal but never validated symlink targets in member.linkname. No public exploit identified at time of analysis and it is not in CISA KEV, but the flaw is confirmed and fully described by the vendor GHSA advisory with vulnerable source shown.
Arbitrary code execution in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to compromise the server. The attacker can execute arbitrary code as the Cribl server process by importing a crafted Git repository containing a symbolic link in the pack's functions directory. No public exploit is known, and there is no evidence of active exploitation at this time.
Authenticated remote attackers holding a valid QuMagie account can exploit a Unix symbolic-link following flaw (CWE-61) in QNAP's QuMagie photo and media management application to compromise the security of the underlying NAS system. The vulnerable code follows attacker-influenced symlinks during file operations, allowing file reads and writes outside the intended media library boundaries, with the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflecting high confidentiality, integrity and availability impact that crosses a security scope boundary - essentially escaping the application sandbox to reach the host NAS. Exploitation requires the attacker to first obtain a QuMagie user account (PR:L) and the ability to place a symlink or control a path the app will follow; no victim interaction is needed. There is no public exploit identified at time of analysis, and QNAP has released a fix in QuMagie 2.9.2 and later.
Path traversal in Flatpak's handling of the export/bin directory during application deployment allows a malicious Flatpak app to delete attacker-chosen files outside the deployment directory when that app is installed or upgraded; on system-wide installations the deletions are carried out with root privileges, so a crafted package can remove arbitrary files anywhere the deployer can reach. The flaw affects Flatpak releases before 1.18.4 and is triggered by a user or administrator installing or upgrading an attacker-supplied app, which supplies the required user interaction rather than a network-based trigger; the CVSS vector carries PR:N, so no prior authentication is needed beyond that install action. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation, though the integrity and availability impact is high (arbitrary file deletion) and the flaw crosses a privilege boundary on system-wide installs.
Path traversal in Flatpak's app deployment handling of the exported files/etc directory allows a malicious Flatpak application to empty or replace host files such as /etc/passwd, /etc/group, /etc/machine-id, or /etc/resolv.conf with a symlink when that app is installed or upgraded; on system-wide installations the write is carried out as root. Exploitation is gated on user interaction: the victim must choose to install or upgrade the attacker-supplied app from an untrusted source (CVSS 3.1 base 7.1, AV:N/AC:L/PR:N/UI:R with high availability and low integrity impact), making this a genuine but moderate-priority integrity/availability issue rather than a critical remote code execution flaw. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Local privilege escalation to root in Flatpak before 1.18.1 lets an unprivileged user holding an active local session abuse the revokefs writer used by flatpak-system-helper: by opening two concurrent revokefs sessions and planting a symlink from one session directory into the other, the attacker retains a file descriptor into a peer session and keeps modifying its files after the system helper has already validated and imported them. The practical payoff is tampering with ostree commit objects in the system repository after signature verification, which translates into root-controlled writes to attacker-chosen paths. Exploitation requires local access and winning a TOCTOU race against the dual-session setup (CVSS AV:L/AC:H/PR:N), and no public exploit code has been identified at time of analysis; the issue is not confirmed as actively exploited (not in CISA KEV).
Sandbox escape in Flatpak before 1.18.1 allows a malicious sandboxed application to gain arbitrary read and write access to host filesystem paths, with direct escalation to code execution outside the sandbox. The root cause is missing symlink validation in Flatpak's app data directory bind-mount logic: attacker-controlled path components (such as the 'tmp' directory under ~/.var/app/APP_ID/cache/) can be replaced with symlinks pointing to arbitrary host locations, which the Linux kernel resolves when bwrap processes the bind-mount. No public exploit has been identified at time of analysis, and this is catalogued as a separate issue from the related CVE-2026-76925.
Symlink following in Dell PowerProtect Cyber Recovery (versions prior to 20.3.0.0) enables a low-privileged local attacker to perform script injection by redirecting privileged file operations through attacker-controlled symbolic links. All three impact dimensions - confidentiality, integrity, availability - are rated High by the vendor, reflecting the potential for full local system compromise on a sensitive data-protection appliance. No public exploit exists and EPSS sits at the 2nd percentile (0.11%), with SSVC confirming no observed active exploitation, indicating limited near-term real-world risk despite the High CVSS score.
Symlink following vulnerability across nine Dell enterprise storage and infrastructure products enables a locally authenticated, low-privileged attacker to elevate their privileges, potentially achieving full system compromise (C:H/I:H/A:H). Affected platforms span Dell AppSync 4.6.0.0, Metro Node 8.0.0, UCC Edge 3.0.1, VxRail 8.0.322, PowerMax 10.3.0, Unity 5.4, PowerFlex Manager 4.5.4, PowerFlex Intelligent Catalog 46.377.00 and 46.382.00, and PowerFlex Rack 4.5.4 and prior. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis, but the breadth of affected Dell enterprise products and the high-impact CVSS metrics make patching a priority for organizations running Dell storage infrastructure.
Arbitrary file read in rsync before 3.5.0 enables attackers with local low-privilege access to read files accessible to the rsync daemon process by exploiting improper symlink resolution in input configuration file handling. The vulnerability affects --files-from, --password-file, and filter merge file paths, allowing placement of a symlink at a predictable argument path or supply of a --files-from path that escapes the daemon module root. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vendor has released a confirmed fix in rsync 3.5.0.
Arbitrary host file write in termux/proot-distro before 5.1.5 lets a malicious rootfs tarball or Docker layer plant an absolute-path symlink during `proot-distro install`, so a follow-up file member is written through that symlink onto the host filesystem - outside the container, before it is ever run. The install/reset paths (_extract_plain_tar) and the Docker layer path (_apply_layer) validated member names for '..' traversal but never validated symlink targets in member.linkname. No public exploit identified at time of analysis and it is not in CISA KEV, but the flaw is confirmed and fully described by the vendor GHSA advisory with vulnerable source shown.
Arbitrary code execution in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to compromise the server. The attacker can execute arbitrary code as the Cribl server process by importing a crafted Git repository containing a symbolic link in the pack's functions directory. No public exploit is known, and there is no evidence of active exploitation at this time.