LIBEXPAT · CVE-2026-128241 · Other
NO FIX YET
The xmlwf tool in libexpat through 2.10.0 opens output files with fopen("wb") in its -d mode, which follows symbolic links. A local attacker with write access to the output directory can plant a symlink to truncate or overwrite files writable by the user running xmlwf.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only systems where xmlwf runs with -d output mode and an untrusted local user can write to the output directory. Exposure requires local write access, so systems without shared or untrusted local users are low risk. The sources do not name a fixed version.
Not affected if no-local-untrusted-users, xmlwf-not-used-with-d-mode
Who cares libexpat, local-users, xmlwf
Unknown from the sources.
No fix yet, per the sources.
The xmlwf tool in libexpat through 2.10.0 contains a symlink following vulnerability because -d output mode opens files with fopen("wb"), which follows symbolic links. Local attackers with write access to the output directory can plant a symlink at the expected output name to truncate or overwrite files writable by the xmlwf user.
This page as .md · .json · CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.