SB2026080122 - Link following in gns3-server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026080122

SB2026080122 - Link following in gns3-server

Published: August 1, 2026

Security Bulletin ID SB2026080122
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Link following (CVE-ID: N/A)

CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper link resolution in gns3server.controller.import_project._create_symbolic_links when processing an uploaded .gns3project archive. A remote attacker can upload a specially crafted project archive containing a symlink entry to disclose sensitive information.

The issue is reachable through the project import endpoint, and the planted symlink can then be retrieved through the project export endpoint.


Remediation

Install update from vendor's website.

References