Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2026-115709

Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
elastic

Description

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Elastic Elastic Cloud Enterprise

Default version status: unaffected

  • 2.6.0 to ≤ 3.8.5affected
  • 4.0.0 to ≤ 4.2.0affected

References