CVE-2026-128241: libexpat xmlwf through 2.10.0 Symlink Following via -d Output Directory
The xmlwf tool in libexpat through 2.10.0 contains a symlink following vulnerability because -d output mode opens files with fopen("wb"), which follows symbolic links. Local attackers with write access to the output directory can plant a symlink at the expected output name to truncate or overwrite files writable by the xmlwf user.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems are exposed when xmlwf is run with -d and writes into a directory that a local attacker can modify. The impact is limited to files that are writable by the user running xmlwf.
What does an attacker need to exploit it?
The attacker needs local write access to the output directory and must create a symbolic link using the output filename xmlwf is expected to open. Exploitation also requires a user to run xmlwf in -d output mode.
Are default xmlwf invocations affected?
The vulnerable behavior is specifically tied to -d output mode. The provided information does not indicate that invocations without -d create the affected output files.
What can be done if updating is not immediately possible?
Avoid using xmlwf with -d in directories writable by untrusted local users. Use an output directory owned and writable only by the account that runs xmlwf.
How can I determine whether a workflow is at risk?
Check whether xmlwf version 2.10.0 or earlier is invoked with -d and whether another local user or untrusted process can create files or symlinks in the chosen output directory.