{"id":"CVE-2026-91761","kind":"vulnerability","aliases":["CVE-2026-91761"],"related":[],"title":"Hitachi Dynamic Link Manager for Linux: symlink following lets local users write files","description":"UNIX Symbolic Link (Symlink) Following Vulnerability in Hitachi Dynamic Link Manager for Linux.\n\nThis issue affects Hitachi Dynamic Link Manager for Linux: from 8.6.2.-00 before 9.0.5-00.","summary":"Hitachi Dynamic Link Manager for Linux follows UNIX symbolic links in a way that can be abused. A local user may be able to make the product act on files they should not reach, per the NVD description.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Hitachi Dynamic Link Manager for Linux","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["dynamic-link-manager","hitachi","infrastructure","linux","multipath"],"not_affected_if":["not-in-version-range"],"how_to_check":"- Check the installed Dynamic Link Manager for Linux version against the affected range (8.6.2-00 up to but not including 9.0.5-00).","fix":"- Hitachi Dynamic Link Manager for Linux: move to `9.0.5-00` or later, per the affected range in the NVD description.","status":"open","published_at":"2026-11-10T05:18:15+00:00","first_seen_at":"2026-11-10T05:19:59+00:00","triaged_at":"2026-11-10T05:22:09+00:00","updated_at":"2026-11-10T05:22:09+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T05:22:09Z","model":"claude-haiku-5-5","output":{"fix":"- Hitachi Dynamic Link Manager for Linux: move to `9.0.5-00` or later, per the affected range in the NVD description.","reach":"local","title":"Hitachi Dynamic Link Manager for Linux: symlink following lets local users write files","impact":"medium","summary":"Hitachi Dynamic Link Manager for Linux follows UNIX symbolic links in a way that can be abused. A local user may be able to make the product act on files they should not reach, per the NVD description.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["hitachi","linux","dynamic-link-manager","multipath"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"local user may alter or read files outside intended paths","analyst_note":"Confirm the exact privilege needed and which files are affected in the Hitachi advisory; NVD text alone is thin.","how_to_check":"- Check the installed Dynamic Link Manager for Linux version against the affected range (8.6.2-00 up to but not including 9.0.5-00).\n- unknown for other checks; the sources do not say which file or setting is involved.","plain_action":"","product_name":"Hitachi Dynamic Link Manager for Linux","needs_analyst":true,"not_affected_if":["not-in-version-range"],"who_is_affected":"Teams running Hitachi Dynamic Link Manager for Linux in the affected range (8.6.2-00 before 9.0.5-00) on Linux servers. The sources do not describe the exact configuration needed to trigger the flaw, so the exposure of any given install is unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000764,"input_tokens":4553,"output_tokens":617,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-00':96C,99C '-2026':15A,18A '-91761':16A,19A '8.6.2':95C '9.0.5':98C 'abl':56B 'abus':50B 'act':61B 'affect':87C 'cve':14A,17A 'descript':71B 'dynam':2A,27B,35B,80C,89C 'dynamic':21A 'dynamic-link-manag':26B 'file':13A,63B 'follow':8A,40B,76C 'for':24A 'hitachi':1A,20A,30B,34B,79C,88C 'infrastructur':31B 'issu':86C 'let':9A 'link':3A,22A,28B,36B,43B,74C,81C,90C 'linux':6A,25A,32B,39B,84C,93C 'local':10A,52B 'make':58B 'manag':4A,29B,37B,82C,91C 'manager':23A 'may':54B 'multipath':33B 'nvd':70B 'per':68B 'product':60B 'reach':67B 'symbol':42B,73C 'symlink':7A,75C 'unix':41B,72C 'user':11A,53B 'vulner':77C 'way':46B 'write':12A","nicknames":[],"mitigations":[],"who_affected":"Teams running Hitachi Dynamic Link Manager for Linux in the affected range (8.6.2-00 before 9.0.5-00) on Linux servers. The sources do not describe the exact configuration needed to trigger the flaw, so the exposure of any given install is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["dynamiclinkmanagerforlinux","hitachidynamiclinkmanagerforlinux"],"ptokens":["dynamic","for","hitachi","link","linux","manager"],"labels":["dynamiclinkmanager","high","hitachi","infrastructure","linux","multipath","vendor"],"campaign_type":null,"search_a":"'-2026':15A,18A '-91761':16A,19A 'cve':14A,17A 'dynam':2A 'dynamic':21A 'file':13A 'follow':8A 'for':24A 'hitachi':1A,20A 'let':9A 'link':3A,22A 'linux':6A,25A 'local':10A 'manag':4A 'manager':23A 'symlink':7A 'user':11A 'write':12A","search_b":"'abl':56B 'abus':50B 'act':61B 'descript':71B 'dynam':27B,35B 'dynamic-link-manag':26B 'file':63B 'follow':40B 'hitachi':30B,34B 'infrastructur':31B 'link':28B,36B,43B 'linux':32B,39B 'local':52B 'make':58B 'manag':29B,37B 'may':54B 'multipath':33B 'nvd':70B 'per':68B 'product':60B 'reach':67B 'symbol':42B 'unix':41B 'user':53B 'way':46B","search_c":"'-00':96C,99C '8.6.2':95C '9.0.5':98C 'affect':87C 'dynam':80C,89C 'follow':76C 'hitachi':79C,88C 'issu':86C 'link':74C,81C,90C 'linux':84C,93C 'manag':82C,91C 'symbol':73C 'symlink':75C 'unix':72C 'vulner':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T05:18:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","cvss_by":"hirt@hitachi.co.jp","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91761","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91761","severity":null,"published_at":"2026-11-10T05:18:15+00:00","modified_at":"2026-11-10T05:18:15+00:00","first_seen_at":"2026-11-10T05:19:59+00:00","fetched_at":"2026-11-10T05:19:59+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}