Bug 2551238 (CVE-2026-70165)
| Summary: | CVE-2026-70165 dotnet: dotnet: Local privilege escalation via improper link resolution | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in .NET. An authorized local attacker could exploit this vulnerability to achieve privilege escalation on the host system. The issue is caused by improper link resolution before file access, where the application fails to properly validate file links. By manipulating these links, an attacker can trick the application into accessing unintended files with elevated permissions.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. Affected products: - .NET SDK (release 10.0): 10.0.100 - 10.0.112; fixed 10.0.113 - .NET SDK (release 11.0): 11.0.100-preview.1 - 11.0.100-rc.1; fixed 11.0.100-rc.2 - .NET SDK (release 10.0): 10.0.400 - 10.0.401; fixed 10.0.402