PULSE
ESPT
FEED
ransomvexy ransomware reclama a Franc-Oil · NG · Energy & Utilitiesransomvexy ransomware reclama a Osiiminppal · GLransomvexy ransomware reclama a Upper Web · BR · Technologyransomsafepay reclama a toyokiki-thailand.com · TH · Manufacturingransomincransom reclama a axiscades.com · IN · Manufacturingransomcurious worm reclama a benchmarkseniorliving.com · US · Healthcareransomaoqin reclama a Airblue · PK · Transportationransompanzer reclama a Ministry of Health Malaysia · MY · Government & Defenseransomkrybit reclama a cey-tech.com · CY · Technologyransommetaencryptor reclama a Promantra, Inc. · US · Technologyransomincransom reclama a CIMSA LOGISTICS · US · Transportationransomincransom reclama a HELP Foundation · US · Otherransomincransom reclama a gamechangerwm.com · US · Professional Servicesransomincransom reclama a raymondjames.com · US · Financial Servicesransomvexy ransomware reclama a Franc-Oil · NG · Energy & Utilitiesransomvexy ransomware reclama a Osiiminppal · GLransomvexy ransomware reclama a Upper Web · BR · Technologyransomsafepay reclama a toyokiki-thailand.com · TH · Manufacturingransomincransom reclama a axiscades.com · IN · Manufacturingransomcurious worm reclama a benchmarkseniorliving.com · US · Healthcareransomaoqin reclama a Airblue · PK · Transportationransompanzer reclama a Ministry of Health Malaysia · MY · Government & Defenseransomkrybit reclama a cey-tech.com · CY · Technologyransommetaencryptor reclama a Promantra, Inc. · US · Technologyransomincransom reclama a CIMSA LOGISTICS · US · Transportationransomincransom reclama a HELP Foundation · US · Otherransomincransom reclama a gamechangerwm.com · US · Professional Servicesransomincransom reclama a raymondjames.com · US · Financial Services
← All CVEs
CVE WatchNov 12, 2026

CVE-2026-111433

UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux. This vulnerability is associated with program file src/d

CVSS

8.6

High

EPSS

—

KEV

—

Exploit Today

0

0-100

Published: Nov 12, 2026 · Last modified: Nov 12, 2026 · CWE-61

EPSS · 30d

Not enough EPSS history yet.

Technical description

UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux. This vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c. This issue affects iSulad: through 2.1.6. If an attacker can get the victim or the platform to run their crafted malicious image, they can cause the iSulad daemon to copy sensitive host directories into an anonymous volume when creating a container, which the container can then read.

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-928647.3 HIG
2.5%
——1Insecure Temporary File Vulnerability in Hitachi Dynamic Link Manager for AIX (for markets outside Japan) and Hitachi Dynamic Link Manager EX for AIX (for the Japanese market). This issue affects Hitachi Dynamic Link Manager for AIX: from 7.4.1-00 before 9.0.4-01; Hitachi Dynamic Link Manager EX for AIX: from 7.4.1-00 before 9.0.4-01.2dCVE-2026-917638.2 HIG
2.7%
——1UNIX Symbolic Link (Symlink) Following Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 8.6.2.-00 before 9.0.5-00.2dCVE-2026-917627.9 HIG
1.7%
——1UNIX Symbolic Link (Symlink) Following Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 8.5.3.-00 before 9.0.5-00.2dCVE-2026-917618.2 HIG
6.6%
——2UNIX Symbolic Link (Symlink) Following Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 8.6.2.-00 before 9.0.5-00.2dCVE-2026-1245844.4 MED
3.2%
——1A vulnerability has been found in wummel patool 4.1.0. This vulnerability affects the function extract_gzip of the file patoolib/fileutil.py of the component Gzip Extraction Handler. The manipulation leads to symlink following. Local access is required to approach this attack. The researcher claims to have submitted a GHSA on the repository of the project.4dCVE-2026-1239628.4 HIG
9.2%
——3In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorized_keys file to be a symlink. NOTE: FreedomBox is a Debian Pure Blend, which means that it distributes its software through Debian repositories.6h