EUVD-2026-58714
UNIX Symbolic Link (Symlink) Following (CWE-61)
N/A
vendor:alpine
5.1
CVSS 4.0 · NVD
Share
Severity by source
NVD
PRIMARY
5.1
MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Lifecycle Timeline
2
Patch available
Aug 14, 2026 - 17:01 EUVD
Analysis Generated
May 27, 2026 - 22:56 vuln.today
DescriptionCVE.org
Alpine Linux: crun fixed in 1.28-r0
AnalysisAI
crun, a lightweight OCI container runtime written in C, received a security fix in Alpine Linux package version 1.28-r0. The nature of the underlying vulnerability is not disclosed in available intelligence - no CVSS score, CWE classification, or technical description has been published. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Access
Unknown prerequisite met
Exploit
Interact with vulnerable crun runtime
Execution
Trigger unspecified vulnerability
Impact
Achieve unspecified impact
Access
Unknown prerequisite met
Exploit
Interact with vulnerable crun runtime
Execution
Trigger unspecified vulnerability
Impact
Achieve unspecified impact
Vulnerability AssessmentAI
| Exploitation | Exploitation conditions cannot be determined from the available data - no CVE description, CWE, or CVSS vector was provided. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Risk assessment is severely constrained by missing data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Without a published vulnerability description or CVSS vector, a realistic exploit scenario cannot be responsibly constructed. In general terms, a vulnerability in a container runtime like crun could be triggered by a malicious or compromised container workload attempting to escape isolation boundaries, but no specific attack path for this CVE is documented. … |
| Remediation | Update the crun package on Alpine Linux to version 1.28-r0 or later using the standard Alpine package manager: 'apk upgrade crun'. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-61 – UNIX Symbolic Link (Symlink) Following
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).