What is the CVSS score of EUVD-2026-38454?

EUVD-2026-38454 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of pwnlift are affected by EUVD-2026-38454?

pwnlift's Blazor upload handler contains a symlink-following vulnerability (CVE-2026-56815) that permits arbitrary file writes with elevated system privileges when deployed in privileged contexts.

pwnlift EUVD-2026-38454

Q: How to fix or mitigate EUVD-2026-38454?

Within 24 hours: Inventory all pwnlift deployments and determine which run with elevated privileges (root or administrative accounts). Within 7 days: Apply the upstream fix available at GitHub commit d7a95449d9ee1ea09ec1529286685f6187afbbed, or establish an upgrade plan pending formal vendor patch release. Within 30 days: Verify all instances are patched and enforce deployment policy requiring pwnlift to run as a non-privileged user.

| CVE-2026-56815 HIGH

UNIX Symbolic Link (Symlink) Following (CWE-61)

2026-06-23 mitre

GHSA-9x6c-xp5w-ch33

Information Disclosure Pwnlift

7.4

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.4 HIGH

AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.4 HIGH

Local access required to plant the symlink (AV:L); timing/positioning dependency justifies AC:H; unprivileged users can create symlinks in writable directories so PR:N stands; C/I/A all high due to privileged arbitrary file write.

3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 23, 2026 - 15:04 vuln.today

Analysis Generated

Jun 23, 2026 - 15:04 vuln.today

DescriptionCVE.org

pwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in the upload handler in Components/Pages/Home.razor.

AnalysisAI

Symlink following in pwnlift's Blazor upload handler permits arbitrary file write with elevated system privileges when the application is deployed in a privileged (root or high-privilege) context. All pwnlift releases before commit d7a95449d9ee1ea09ec1529286685f6187afbbed are affected through the upload component in Components/Pages/Home.razor. No public exploit has been identified at time of analysis; an upstream fix is available via the referenced GitHub commit.

Technical ContextAI

pwnlift is a .NET Blazor Server application (rasta-mouse/pwnlift) used for file upload operations, commonly in red team or operator contexts. The vulnerable component is Components/Pages/Home.razor, which implements a file upload handler. The root cause is CWE-61 (Improper Resolution of Path Before File Access - Symlink Following): the handler constructed the destination path using Directory.GetCurrentDirectory() without canonicalizing it via Path.GetFullPath() before checking for symlinks or path traversal. As confirmed by the commit diff, the pre-patch code checked for an existing symlink on the Uploads directory but did not re-validate the canonical path after resolution, nor did it canonicalize individual file paths before writing. The fix introduces Path.GetFullPath(destination) for canonical destination resolution, adds Path.GetRelativePath() to validate that each uploaded file's resolved path remains within the Uploads directory, and rejects uploads if the Uploads directory itself is a symlink. CPE cpe:2.3:a:rasta-mouse:pwnlift:*:*:*:*:*:*:*:* covers all versions without a fixed upper bound.

RemediationAI

The primary remediation is to update pwnlift to or beyond commit d7a95449d9ee1ea09ec1529286685f6187afbbed, available at https://github.com/rasta-mouse/pwnlift/commit/d7a95449d9ee1ea09ec1529286685f6187afbbed; note that this is a source-level fix commit, not a tagged release, so operators must build from this commit or later. As an immediate compensating control, run pwnlift as a dedicated unprivileged service account rather than as root or SYSTEM - this eliminates privilege escalation impact and is the most effective non-patch mitigation, at the cost of potentially limiting pwnlift's ability to access restricted directories as intended. Additionally, restrict filesystem permissions on the directory containing the Uploads folder so that only the pwnlift service account can create files or symlinks there, removing the attacker's ability to position the symlink. If privileged operation is operationally required and patching is not yet possible, consider deploying pwnlift inside a container with a read-only root filesystem and a mounted, isolated Uploads volume, which would limit symlink traversal impact to the container boundary.