CVE-2026-56815: pwnlift Privilege Escalation Vulnerability

CVE-2026-56815 Overview

CVE-2026-56815 is a symlink following vulnerability in pwnlift, a Blazor-based offensive security utility. The flaw exists in the upload handler within Components/Pages/Home.razor and affects versions prior to commit d7a9544. When pwnlift runs in a privileged deployment, an attacker who controls the working directory can replace the Uploads folder with a symbolic link. The upload handler follows the link, allowing arbitrary file writes to attacker-chosen locations on the host. The issue is tracked under [CWE-61: UNIX Symbolic Link (Symlink) Following].

Critical Impact
Local attackers can write attacker-supplied files outside the intended upload directory, leading to integrity loss and potential code execution in privileged contexts.

Affected Products

pwnlift versions before commit d7a9544
Privileged deployments of pwnlift using the default Uploads directory
Blazor server component Components/Pages/Home.razor

Discovery Timeline

2026-06-23 - CVE-2026-56815 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-56815

Vulnerability Analysis

The vulnerability resides in the file upload handler implemented in Components/Pages/Home.razor. Before the patch, the handler resolved its upload destination using Path.Combine(Directory.GetCurrentDirectory(), "Uploads"). The current working directory is attacker-influenceable in many deployment scenarios, including service launches and shell invocations. If an attacker pre-creates Uploads as a symbolic link pointing to a sensitive location, the upload routine writes user-supplied files through that link. In privileged deployments, this allows writes into directories such as system configuration paths or service binaries.

Root Cause

The handler trusted Directory.GetCurrentDirectory() for path resolution and did not canonicalize the final upload path. It also failed to validate that each written file remained inside the intended directory after symlink resolution. The reparse-point check that did exist ran only after the directory was created, leaving a window for symlink substitution.

Attack Vector

Exploitation requires local access to influence the working directory and place a symlink at the Uploads path before the application initializes the destination. The attacker then uploads files through the application interface. Each upload is written through the symlink to the attacker-chosen target.

text

     {
         Snackbar.Configuration.PositionClass = Defaults.Classes.Position.TopRight;
 
-        var destination = Path.Combine(Directory.GetCurrentDirectory(), "Uploads");
+        var destination = Path.Combine(AppContext.BaseDirectory, "Uploads");
 
         if (!Directory.Exists(destination))
             Directory.CreateDirectory(destination);
-        
+
         var destInfo = new DirectoryInfo(destination);
         if (destInfo.Attributes.HasFlag(FileAttributes.ReparsePoint))
         {
-            Snackbar.Add("Upload rejected: Uploads directory is a symlink", Severity.Error);
+            Snackbar.Add("Upload directory is a symbolic link - uploads disabled.", Severity.Error);
             return;
         }
 
+        var canonicalDest = Path.GetFullPath(destination);
+
         foreach (var file in _files)
         {
             try

Source: GitHub Commit for Pwnlift. The patch switches the base path to AppContext.BaseDirectory, retains the reparse-point check, and computes canonicalDest via Path.GetFullPath for per-file containment validation.

Detection Methods for CVE-2026-56815

Indicators of Compromise

Presence of a symbolic link named Uploads in the working directory of the pwnlift process where a regular directory is expected.
File creation events under the pwnlift process whose final resolved paths fall outside the application base directory.
Unexpected files appearing in privileged system paths shortly after pwnlift upload activity.

Detection Strategies

Monitor for file system reparse-point or symlink creation events targeting the pwnlift runtime directory.
Correlate pwnlift process file-write events with destination paths outside AppContext.BaseDirectory.
Alert on pwnlift execution under privileged accounts such as root or SYSTEM.

Monitoring Recommendations

Enable file integrity monitoring on system directories writable by the account running pwnlift.
Audit working-directory changes for services launching pwnlift and log the resolved current directory at startup.
Track the SHA or commit version of deployed pwnlift binaries against the patched commit d7a9544.

How to Mitigate CVE-2026-56815

Immediate Actions Required

Update pwnlift to a build that includes commit d7a9544 or later.
Stop running pwnlift under privileged accounts; run it as a dedicated low-privilege user.
Verify that the Uploads directory under the application base directory is a real directory and not a symlink.
Restrict filesystem permissions on the pwnlift working directory so only the service account can create entries.

Patch Information

The upstream fix is available in the merge commit d7a9544. The patch replaces Directory.GetCurrentDirectory() with AppContext.BaseDirectory, preserves the reparse-point rejection, and uses Path.GetFullPath to canonicalize the destination before writing each uploaded file. Additional context is available in the Openwall OSS Security Discussion.

Workarounds

Launch pwnlift from a controlled directory that the service account exclusively owns, removing any pre-existing Uploads entry beforehand.
Apply mandatory access controls such as AppArmor or SELinux to constrain pwnlift file writes to the intended upload path.
Disable the upload feature in deployments where it is not required until the patched build is installed.

bash

# Configuration example: deploy pwnlift under a dedicated, unprivileged user
sudo useradd -r -s /usr/sbin/nologin pwnlift
sudo install -d -o pwnlift -g pwnlift -m 0750 /opt/pwnlift
sudo install -d -o pwnlift -g pwnlift -m 0750 /opt/pwnlift/Uploads

# Verify Uploads is a real directory, not a symlink
test -L /opt/pwnlift/Uploads && echo "ERROR: Uploads is a symlink" || echo "OK"

# Run pwnlift from its base directory under the dedicated account
sudo -u pwnlift sh -c 'cd /opt/pwnlift && ./pwnlift'