Link following in gns3-server - #VU140704
Published: August 1, 2026
Vulnerability identifier: #VU140704
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: N/A
CWE-ID: CWE-59
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Affected software:
gns3-server
gns3-server
Detailed vulnerability description
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper link resolution in gns3server.controller.import_project._create_symbolic_links when processing an uploaded .gns3project archive. A remote attacker can upload a specially crafted project archive containing a symlink entry to disclose sensitive information.
The issue is reachable through the project import endpoint, and the planted symlink can then be retrieved through the project export endpoint.
Remediation
Install security update from vendor's website.