AZL-113822
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-113822.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-113822
- Upstream
- Published
- 2026-11-13T10:18:12Z
- Modified
- 2026-11-14T14:17:47Z
- Summary
- CVE-2026-128241 affecting package expat 2.9.0-1
- Details
-
The xmlwf tool in libexpat through 2.10.0 contains a symlink following vulnerability because -d output mode opens files with fopen("wb"), which follows symbolic links. Local attackers with write access to the output directory can plant a symlink at the expected output name to truncate or overwrite files writable by the xmlwf user.
- References