Symlink Following Vulnerability in npitre cramfs-tools by npitre
CVE-2026-8784

4.6MEDIUM

Key Information:

Vendor

Npitre

Status
Cramfs-tools
Vendor
CVE Published:
18 May 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-8784?

A vulnerability exists in npitre cramfs-tools versions up to 2.2, specifically within the change_file_status function in cramfsck.c. This vulnerability enables symlink following, allowing an attacker with local access to exploit the system. A patch has been released (commit b4a3a695c9873f824907bd15659f2a6ac7667b4f) to address this issue, and users are strongly advised to apply it promptly to mitigate potential risks associated with unauthorized access.

Affected Version(s)

cramfs-tools 2.0

cramfs-tools 2.1

cramfs-tools 2.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-8784 - Proof of Concept

References

https://vuldb.com/vuln/364408
vdb-entrytechnical-description
https://vuldb.com/vuln/364408/cti
signaturepermissions-required
https://vuldb.com/submit/811897
third-party-advisory

CVSS V4

Score:
4.6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

nich0las (VulDB User)
.