Link following in gns3-server - #VU140704
Published: August 1, 2026
Vulnerability identifier: #VU140704
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-59
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper link resolution in gns3server.controller.import_project._create_symbolic_links when processing an uploaded .gns3project archive. A remote attacker can upload a specially crafted project archive containing a symlink entry to disclose sensitive information.
The issue is reachable through the project import endpoint, and the planted symlink can then be retrieved through the project export endpoint.
Affected software
gns3-server
Remediation
Install security update from vendor's website.
gns3-server - update to 2.2.61