CWE-59

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "bastille",
          "vendor": "BastilleBSD",
          "versions": [
            {
              "lessThanOrEqual": "1.4.4",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-10-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allows jailed users to escape jail isolation. Attackers inside a jail can plant symlinks pointing to host paths or other jail roots, so administrator-run copies overwrite or read host files with root privileges."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T15:16:04.687Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #1673",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/BastilleBSD/bastille/issues/1673"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/BastilleBSD/bastille"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/BastilleBSD/bastille/commit/accc246ba92602c355afc66d0d8b9d43277532e1"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/BastilleBSD/bastille/blob/1.4.4/usr/local/share/bastille/cp.sh#L98-L110"
        },
        {
          "name": "VulnCheck Advisory: Bastille through 1.4.4 Jail Escape via Symlink Following in cp, rcp, jcp",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/bastille-through-1.4.4-jail-escape-via-symlink-following-in-cp-rcp-jcp"
        }
      ],
      "title": "Bastille through 1.4.4 Jail Escape via Symlink Following in cp, rcp, jcp",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119704",
    "datePublished": "2026-10-30T15:16:04.687Z",
    "dateReserved": "2026-10-30T14:49:22.641Z",
    "dateUpdated": "2026-10-30T15:16:04.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119364",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T15:20:52.024825Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T15:56:45.622Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/proftpd/proftpd",
          "product": "ProFTPD",
          "repo": "https://github.com/proftpd/proftpd",
          "vendor": "ProFTPD Project",
          "versions": [
            {
              "lessThanOrEqual": "1.3.9e",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.3.10rc5",
              "status": "affected",
              "version": "1.3.10rc1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.3.9e",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:proftpd:proftpd:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.3.10rc5",
                  "versionStartIncluding": "1.3.10rc1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abraxas Labs"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "TJ Saunders"
        }
      ],
      "datePublic": "2026-10-17T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. Attackers can place a symlink in a writable directory and use SITE COPY or SITE CPTO to overwrite files in write-denied locations."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T11:30:37.047Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/proftpd/proftpd/issues/2374"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/proftpd/proftpd/commit/c41691f8981f98081fcb8a535c3c21b06a3f04af"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/proftpd/proftpd/blob/v1.3.9e/contrib/mod_copy.c#L620"
        },
        {
          "name": "ProFTPD v1.3.10rc5 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc5"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://abraxaslabs.tech/research/proftpd-site-copy-dest-follow"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/proftpd/proftpd"
        },
        {
          "name": "VulnCheck Advisory: ProFTPD through 1.3.9e and 1.3.10rc4 mod_copy Symlink Following Write Bypass",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/proftpd-through-1.3-9e-and-1.3-10rc4-mod-copy-symlink-following-write-bypass"
        }
      ],
      "title": "ProFTPD through 1.3.9e and 1.3.10rc4 mod_copy Symlink Following Write Bypass",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119364",
    "datePublished": "2026-10-30T11:30:37.047Z",
    "dateReserved": "2026-10-30T00:26:48.481Z",
    "dateUpdated": "2026-10-30T15:56:45.622Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119336",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T21:21:13.368597Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T22:14:23.468Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "pi-hole",
          "vendor": "pi-hole",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.4.2, \u003c 6.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker executing as pihole can replace that path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive target world-readable without truncating it. This issue is fixed in version 6.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-61",
              "description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T20:05:40.100Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pi-hole/pi-hole/security/advisories/GHSA-xch2-4qxw-g5vj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pi-hole/pi-hole/security/advisories/GHSA-xch2-4qxw-g5vj"
        },
        {
          "name": "https://github.com/pi-hole/pi-hole/pull/6719",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pi-hole/pi-hole/pull/6719"
        },
        {
          "name": "https://github.com/pi-hole/pi-hole/commit/85de82dd2b63bf71ecb936177dfb82421d9d2f25",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pi-hole/pi-hole/commit/85de82dd2b63bf71ecb936177dfb82421d9d2f25"
        },
        {
          "name": "https://github.com/pi-hole/pi-hole/commit/c1062f43b0de1876321bafac58fba862406366cb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pi-hole/pi-hole/commit/c1062f43b0de1876321bafac58fba862406366cb"
        },
        {
          "name": "https://github.com/pi-hole/pi-hole/commit/e05dc3f139206fd8d0e4a052dceefb9056533517",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pi-hole/pi-hole/commit/e05dc3f139206fd8d0e4a052dceefb9056533517"
        },
        {
          "name": "https://github.com/pi-hole/pi-hole/releases/tag/v6.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pi-hole/pi-hole/releases/tag/v6.5"
        }
      ],
      "source": {
        "advisory": "GHSA-xch2-4qxw-g5vj",
        "discovery": "UNKNOWN"
      },
      "title": "Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119336",
    "datePublished": "2026-10-30T20:05:40.100Z",
    "dateReserved": "2026-10-29T20:44:30.286Z",
    "dateUpdated": "2026-10-30T22:14:23.468Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "pi-hole",
          "vendor": "pi-hole",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a different file. A pihole-readable decoy can therefore pass the check while curl reads a root-only target, and /proc/self paths can similarly resolve against different processes. Exploitation requires an administrator who can add adlists and can place a symlink and decoy on the filesystem. This issue is fixed in version 6.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.2,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T20:01:59.115Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pi-hole/pi-hole/security/advisories/GHSA-g63w-24cr-p3w6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pi-hole/pi-hole/security/advisories/GHSA-g63w-24cr-p3w6"
        },
        {
          "name": "https://github.com/pi-hole/pi-hole/pull/6719",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pi-hole/pi-hole/pull/6719"
        },
        {
          "name": "https://github.com/pi-hole/pi-hole/commit/14554737be53c392abffc69677f6b9df02ae7971",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pi-hole/pi-hole/commit/14554737be53c392abffc69677f6b9df02ae7971"
        },
        {
          "name": "https://github.com/pi-hole/pi-hole/releases/tag/v6.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pi-hole/pi-hole/releases/tag/v6.5"
        }
      ],
      "source": {
        "advisory": "GHSA-g63w-24cr-p3w6",
        "discovery": "UNKNOWN"
      },
      "title": "Pi-hole: file:// adlist read check and curl can resolve different files"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119334",
    "datePublished": "2026-10-30T20:01:59.115Z",
    "dateReserved": "2026-10-29T20:44:30.285Z",
    "dateUpdated": "2026-10-30T20:01:59.115Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "zuke",
          "vendor": "zuke-build",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but then performs link-following reads, writes, and permission changes in zuke setup and zuke import. An attacker who supplies an untrusted cloned repository, template, or archive with a symbolic link at a scaffolded name can cause setup to overwrite a target outside the selected directory with the invoking user\u0027s permissions. The .gitignore path requires no flag, while --force permits a linked launcher target to be written and made executable; import can also read link-target content and incorporate it into the generated build file. This issue is fixed in version 1.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T15:52:01.029Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/zuke-build/zuke/security/advisories/GHSA-hc8w-3fgv-22pw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/zuke-build/zuke/security/advisories/GHSA-hc8w-3fgv-22pw"
        },
        {
          "name": "https://github.com/zuke-build/zuke/pull/542",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zuke-build/zuke/pull/542"
        },
        {
          "name": "https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zuke-build/zuke/commit/4257b0bc5ef5e387a44f913349646d4baccd1654"
        },
        {
          "name": "https://github.com/zuke-build/zuke/releases/tag/cli-v1.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/zuke-build/zuke/releases/tag/cli-v1.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-hc8w-3fgv-22pw",
        "discovery": "UNKNOWN"
      },
      "title": "zuke setup and zuke import follow symbolic links planted at scaffold names, allowing writes outside the target directory"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119291",
    "datePublished": "2026-10-30T15:52:01.029Z",
    "dateReserved": "2026-10-29T18:50:28.065Z",
    "dateUpdated": "2026-10-30T15:52:01.029Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119168",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-30T17:19:36.166956Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-30T17:19:47.361Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "product": "Nomad",
          "repo": "https://github.com/hashicorp/nomad",
          "vendor": "HashiCorp",
          "versions": [
            {
              "lessThan": "2.1.1",
              "status": "affected",
              "version": "0.5.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "64 bit",
            "32 bit",
            "x86",
            "ARM",
            "MacOS",
            "Windows",
            "Linux"
          ],
          "product": "Nomad Enterprise",
          "repo": "https://github.com/hashicorp/nomad",
          "vendor": "HashiCorp",
          "versions": [
            {
              "changes": [
                {
                  "at": "1.11.12",
                  "status": "unaffected"
                },
                {
                  "at": "1.10.18",
                  "status": "unaffected"
                }
              ],
              "lessThan": "2.1.0",
              "status": "affected",
              "version": "0.5.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was reported to HashiCorp by Sajda Kabir ([http://github.com/sajdakabir|http://github.com/sajdakabir])."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eHashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.\u003c/p\u003e\u003cbr/\u003e"
            }
          ],
          "value": "HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-132",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-132: Symlink Attack"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (Link Following)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T14:04:51.598Z",
        "orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
        "shortName": "HashiCorp"
      },
      "references": [
        {
          "url": "https://discuss.hashicorp.com/t/hcsec-2026-53-nomad-allocation-data-migration-may-allow-host-directory-permission-modification-via-symlink-following/77931"
        }
      ],
      "source": {
        "advisory": "HCSEC-2026-53",
        "discovery": "EXTERNAL"
      },
      "title": "Nomad allocation data migration may allow host directory permission modification via symlink following"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
    "assignerShortName": "HashiCorp",
    "cveId": "CVE-2026-119168",
    "datePublished": "2026-10-29T18:12:51.268Z",
    "dateReserved": "2026-10-29T15:04:38.269Z",
    "dateUpdated": "2026-10-30T17:19:47.361Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://cpan.org/modules",
          "defaultStatus": "unaffected",
          "modules": [
            "CallBackery"
          ],
          "packageName": "CallBackery",
          "packageURL": "pkg:cpan/CallBackery",
          "programFiles": [
            "lib/CallBackery/Config.pm"
          ],
          "programRoutines": [
            {
              "name": "CallBackery::Config::getConfigBlob"
            }
          ],
          "repo": "https://github.com/oetiker/callbackery",
          "versions": [
            {
              "lessThan": "0.62.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup.\n\ngetConfigBlob() has the sqlite3 shell write the dump to /tmp/cbdump\u003cpid\u003e and never removes it. The file takes the process umask, and a symlink planted at that predictable name is followed.\n\nThe dump holds every user\u0027s password hash and every value saved by the application\u0027s forms. A local user can read these after any backup, and may redirect the dump to a file of their choosing."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-379",
              "description": "CWE-379 Creation of Temporary File in Directory with Insecure Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper Link Resolution Before File Access",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T13:12:29.396Z",
        "orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
        "shortName": "CPANSec"
      },
      "references": [
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://metacpan.org/release/OETIKER/CallBackery-0.62.0/changes"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to CallBackery 0.62.0 or later, and delete any leftover /tmp/cbdump* files."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup",
      "x_generator": {
        "engine": "cpansec-cna-tool 0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
    "assignerShortName": "CPANSec",
    "cveId": "CVE-2026-118990",
    "datePublished": "2026-10-30T13:12:29.396Z",
    "dateReserved": "2026-10-29T10:58:47.285Z",
    "dateUpdated": "2026-10-30T13:12:29.396Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://gitlab.gnome.org/GNOME/epiphany",
          "defaultStatus": "unaffected",
          "packageName": "epiphany",
          "product": "Epiphany",
          "vendor": "GNOME",
          "versions": [
            {
              "lessThan": "*",
              "status": "affected",
              "version": "47.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Red Hat would like to thank Fernando Munoz for reporting this issue."
        }
      ],
      "datePublic": "2026-10-24T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files.\n\nIn src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the installer did not require a real ZIP. A TAR file named *.xpi was extracted. TAR supports hard-link entry types; with Epiphany\u0027s archive_write_disk options (including ARCHIVE_EXTRACT_PERM), a crafted hard-link target can cause an attacker-chosen existing user-writable file to be truncated and overwritten with attacker-controlled content and mode bits, without a dedicated warning dialog, when the user installs or opens the crafted .xpi.\n\nThis is related to but separate from the ZIP-slip path traversal fixed as CVE-2026-77679 (#2922 / MR !2143).\n\nRequirements: the victim must install or open a malicious WebExtension (.xpi).\n\nAffected: Epiphany \u003e= 47.0 (WebExtension XPI install path).\nFixed: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248 (commit 0cc9ab55 \u2014 only enable ZIP format support).\nUpstream: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988\nReporter acknowledgment: Fernando Munoz"
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-31T09:29:37.264Z",
        "orgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
        "shortName": "fedora"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-118599"
        },
        {
          "name": "RHBZ#2562969",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562969"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2988"
        },
        {
          "url": "https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2248"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-23T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-10-24T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install",
      "workarounds": [
        {
          "lang": "en",
          "value": "Do not install WebExtensions (.xpi) from untrusted sources. Prefer keeping WebExtensions disabled when unused (Epiphany can refuse install when the feature is disabled in recent fixes). After any untrusted .xpi install attempt, inspect unexpectedly modified user files (for example shell startup files, autostart desktop entries, or SSH authorized_keys). Upgrade to a fixed Epiphany build containing MR !2248 / commit 0cc9ab55 when available for your stream."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "92fb86c3-55a5-4fb5-9c3f-4757b9e96dc5",
    "assignerShortName": "fedora",
    "cveId": "CVE-2026-118599",
    "datePublished": "2026-10-31T09:29:37.264Z",
    "dateReserved": "2026-10-28T16:47:14.805Z",
    "dateUpdated": "2026-10-31T09:29:37.264Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "filebrowser",
          "vendor": "gtsteffaniak",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.5.2-stable"
            },
            {
              "status": "affected",
              "version": "\u003e= 2.0.0-beta, \u003c 2.0.1-beta"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user\u0027s authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink. An authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink. This issue is fixed in 1.5.2-stable and 2.0.1-beta."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T17:48:04.364Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-mgqf-5mf5-prfj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-mgqf-5mf5-prfj"
        },
        {
          "name": "https://github.com/gtsteffaniak/filebrowser/pull/2795",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gtsteffaniak/filebrowser/pull/2795"
        },
        {
          "name": "https://github.com/gtsteffaniak/filebrowser/pull/2800",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gtsteffaniak/filebrowser/pull/2800"
        },
        {
          "name": "https://github.com/gtsteffaniak/filebrowser/commit/3c8c02414eefd3351ffe437fa39ff6eb150ffa67",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gtsteffaniak/filebrowser/commit/3c8c02414eefd3351ffe437fa39ff6eb150ffa67"
        },
        {
          "name": "https://github.com/gtsteffaniak/filebrowser/commit/4126edeb07a015c3809a89249b283e07a4e50c38",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gtsteffaniak/filebrowser/commit/4126edeb07a015c3809a89249b283e07a4e50c38"
        },
        {
          "name": "https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.5.2-stable",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.5.2-stable"
        },
        {
          "name": "https://github.com/gtsteffaniak/filebrowser/releases/tag/v2.0.1-beta",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gtsteffaniak/filebrowser/releases/tag/v2.0.1-beta"
        }
      ],
      "source": {
        "advisory": "GHSA-mgqf-5mf5-prfj",
        "discovery": "UNKNOWN"
      },
      "title": "FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-116682",
    "datePublished": "2026-10-27T17:48:04.364Z",
    "dateReserved": "2026-10-26T20:00:59.829Z",
    "dateUpdated": "2026-10-27T17:48:04.364Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-116673",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-28T14:34:17.124091Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-28T16:15:47.864Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "systeminformation",
          "vendor": "sebhildebrandt",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.33.14"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/\u003ciface\u003e paths, including the operstate path, without verifying that it is a single interface-name segment or that the resolved path remains under /sys/class/net. An attacker who can control iface and create a directory containing symlinked statistics files can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. The package does not expose a network endpoint, and the demonstrated scenario requires local filesystem setup. This issue is fixed in version 5.33.14."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:38:15.558Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-4vjg-vx72-qq4g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sebhildebrandt/systeminformation/security/advisories/GHSA-4vjg-vx72-qq4g"
        },
        {
          "name": "https://github.com/sebhildebrandt/systeminformation/commit/8d294b3139fec654a912969ac898037578a218cd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sebhildebrandt/systeminformation/commit/8d294b3139fec654a912969ac898037578a218cd"
        },
        {
          "name": "https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.33.14",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sebhildebrandt/systeminformation/releases/tag/v5.33.14"
        }
      ],
      "source": {
        "advisory": "GHSA-4vjg-vx72-qq4g",
        "discovery": "UNKNOWN"
      },
      "title": "systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-116673",
    "datePublished": "2026-10-27T16:38:15.558Z",
    "dateReserved": "2026-10-26T20:00:59.828Z",
    "dateUpdated": "2026-10-28T16:15:47.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}