Servers and applications

CVE-2026-128241

libexpat xmlwf through 2.10.0 Symlink Following via -d Output Directory

Severity: Medium 4.1
Published: 13 Nov 2026
Last changed: 13 Nov 2026
Added to UpHeron: 13 Nov 2026
Weakness: Link following (CWE-59)
Attack: Needs local access · Only under certain conditions · Needs a user account · Needs someone to view a page or file
Attacker can: Change data
CVSS vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Sources: CVE Program

Description

The xmlwf tool in libexpat through 2.10.0 contains a symlink following vulnerability because -d output mode opens files with fopen("wb"), which follows symbolic links. Local attackers with write access to the output directory can plant a symlink at the expected output name to truncate or overwrite files writable by the xmlwf user.

From the CVE Program.

Affected software

Software	Affected versions
ExpatServers and applications · `cna:libexpat project\|libexpat`	Every version up to 2.10.0

References

CVE.org https://www.cve.org/CVERecord?id=CVE-2026-128241