CVE-2026-56815

4th percentile — higher than 4% of all known CVEs

A vulnerability in pwnlift before d7a9544 in a privileged deployment allows an attacker to follow symbolic links in the upload handler in Components/Pages/Home.razor.

An attacker can exploit this flaw to write files to arbitrary locations on the filesystem, potentially leading to privilege escalation or application compromise in a privileged environment.

Immediately update pwnlift to version d7a9544 or later, which includes a fix for the symlink following vulnerability.