Symlink Following Vulnerability in answer-me-with-html by QingYunA
CVE-2026-108723
2LOW
What is CVE-2026-108723?
The answer-me-with-html library, up to version 0.5.0, is vulnerable to a symlink following issue within its CLI code block. Specifically, the function handling the localPath() does not resolve symlinks correctly, which may allow an attacker to craft a repository containing a symlink that points outside of the intended directory. When shared, the generated HTML can expose sensitive external files to unauthorized users, posing a significant risk to data integrity and security.
Affected Version(s)
answer-me-with-html 0 <= 0.5.0
References
CVSS V4
Score:
2
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology