{"id":"CVE-2026-128241","kind":"vulnerability","aliases":["CVE-2026-128241"],"related":[],"title":"libexpat xmlwf: symlink following lets local users overwrite files","description":"The xmlwf tool in libexpat through 2.10.0 contains a symlink following vulnerability because -d output mode opens files with fopen(\"wb\"), which follows symbolic links. Local attackers with write access to the output directory can plant a symlink at the expected output name to truncate or overwrite files writable by the xmlwf user.","summary":"The xmlwf tool in libexpat through 2.10.0 opens output files with fopen(\"wb\") in its -d mode, which follows symbolic links. A local attacker with write access to the output directory can plant a symlink to truncate or overwrite files writable by the user running xmlwf.","severity":"medium","cvss":4.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"libexpat","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["libexpat","local-users","other","xmlwf"],"not_affected_if":["no-local-untrusted-users","xmlwf-not-used-with-d-mode"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T10:18:12+00:00","first_seen_at":"2026-11-13T10:47:33+00:00","triaged_at":"2026-11-13T10:58:49+00:00","updated_at":"2026-11-13T10:58:49+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T10:58:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"libexpat xmlwf: symlink following lets local users overwrite files","impact":"medium","summary":"The xmlwf tool in libexpat through 2.10.0 opens output files with fopen(\"wb\") in its -d mode, which follows symbolic links. A local attacker with write access to the output directory can plant a symlink to truncate or overwrite files writable by the user running xmlwf.","audience":"developers","category":"other","nicknames":[],"who_cares":["libexpat","xmlwf","local-users"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user truncates or overwrites files writable by xmlwf user","analyst_note":"Confirm the fixed libexpat version and whether a patch exists; check the vulncheck advisory for details.","how_to_check":"- unknown","plain_action":"","product_name":"libexpat","needs_analyst":true,"not_affected_if":["no-local-untrusted-users","xmlwf-not-used-with-d-mode"],"who_is_affected":"Only systems where xmlwf runs with -d output mode and an untrusted local user can write to the output directory. Exposure requires local write access, so systems without shared or untrusted local users are low risk. The sources do not name a fixed version.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000709,"input_tokens":4586,"output_tokens":501,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128241':12A,15A '-2026':11A,14A '2.10.0':29B,75C 'access':49B,98C 'attack':46B,95C 'contain':76C 'cve':10A,13A 'd':38B,82C 'directori':53B,102C 'expect':109C 'file':9A,32B,62B,86C,116C 'follow':4A,41B,79C,91C 'fopen':34B,88C 'let':5A 'libexpat':1A,16A,17B,27B,73C 'link':43B,93C 'local':6A,19B,45B,94C 'local-us':18B 'mode':39B,84C 'name':111C 'open':30B,85C 'output':31B,52B,83C,101C,110C 'overwrit':8A,61B,115C 'plant':55B,104C 'run':67B 'symbol':42B,92C 'symlink':3A,57B,78C,106C 'tool':25B,71C 'truncat':59B,113C 'user':7A,20B,66B,121C 'vulner':80C 'wb':35B,89C 'writabl':63B,117C 'write':48B,97C 'xmlwf':2A,22B,24B,68B,70C,120C","nicknames":[],"mitigations":[],"who_affected":"Only systems where xmlwf runs with -d output mode and an untrusted local user can write to the output directory. Exposure requires local write access, so systems without shared or untrusted local users are low risk. The sources do not name a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["libexpat"],"ptokens":["libexpat"],"labels":["libexpat","localusers","medium","other","vendor","xmlwf"],"campaign_type":null,"search_a":"'-128241':12A,15A '-2026':11A,14A 'cve':10A,13A 'file':9A 'follow':4A 'let':5A 'libexpat':1A,16A 'local':6A 'overwrit':8A 'symlink':3A 'user':7A 'xmlwf':2A","search_b":"'2.10.0':29B 'access':49B 'attack':46B 'd':38B 'directori':53B 'file':32B,62B 'follow':41B 'fopen':34B 'libexpat':17B,27B 'link':43B 'local':19B,45B 'local-us':18B 'mode':39B 'open':30B 'output':31B,52B 'overwrit':61B 'plant':55B 'run':67B 'symbol':42B 'symlink':57B 'tool':25B 'truncat':59B 'user':20B,66B 'wb':35B 'writabl':63B 'write':48B 'xmlwf':22B,24B,68B","search_c":"'2.10.0':75C 'access':98C 'attack':95C 'contain':76C 'd':82C 'directori':102C 'expect':109C 'file':86C,116C 'follow':79C,91C 'fopen':88C 'libexpat':73C 'link':93C 'local':94C 'mode':84C 'name':111C 'open':85C 'output':83C,101C,110C 'overwrit':115C 'plant':104C 'symbol':92C 'symlink':78C,106C 'tool':71C 'truncat':113C 'user':121C 'vulner':80C 'wb':89C 'writabl':117C 'write':97C 'xmlwf':70C,120C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T10:18:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128241","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128241","severity":null,"published_at":"2026-11-13T10:18:12+00:00","modified_at":"2026-11-13T10:18:12+00:00","first_seen_at":"2026-11-13T10:47:33+00:00","fetched_at":"2026-11-13T10:47:33+00:00","note":null}],"documents":[{"id":145432,"url":"https://www.vulncheck.com/advisories/libexpat-xmlwf-through-2.10.0-symlink-following-via-d-output-directory","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}