Symbolic Link Vulnerability in Airlink's Daemon for Docker

CVE-2025-57802

What is CVE-2025-57802?

Airlink's Daemon is designed to interface with Docker, enabling secure control of instances via the Panel. However, in version 1.0.0, a security flaw allows an attacker who has gained access to the affected container to create symbolic links within the mounted directory (/app/data). These symbolic links can direct to sensitive areas of the host filesystem due to arbitrary host path bind-mounting. If the application or other processes follow these symlinks, an attacker can achieve unauthorized read access to host files outside of the container environment. This vulnerability has been addressed in version 1.0.1.

References