CVE-2026-108751
Description
A flaw was found in MoAI-ADK. The template deployer does not properly validate destination paths when handling symbolic links (symlinks) during project initialization. An attacker can supply a malicious repository containing a crafted symlink to trick a user into running the initialization process, resulting in the overwriting of arbitrary files writable by the user outside the project directory.
Statement
This vulnerability is rated as having Moderate impact because exploitation requires local user interaction to initialize a project from an untrusted source, restricting potential file tampering to the permissions of the invoking user without elevating privileges. MoAI-ADK is not included or deployed by default within supported Red Hat enterprise environments. In standalone or customized developer setups, an attacker must persuade a user into processing a malicious repository containing pre-staged symlinks to trigger the flaw, limiting the risk of arbitrary remote exploitation.
Understanding the Weakness (CWE)
Confidentiality,Integrity,Access Control
Technical Impact: Read Files or Directories; Modify Files or Directories; Bypass Protection Mechanism
An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism then an attacker may be able to bypass the mechanism.
Other
Technical Impact: Execute Unauthorized Code or Commands
Windows simple shortcuts, sometimes referred to as soft links, can be exploited remotely since a ".LNK" file can be uploaded like a normal file. This can enable remote execution.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
