dbcve.org
Link Following (Symlink)Weakness · CWE-59

CVE-2025-52936

CRITICAL · 9.3 CVSS v4.0 Published 2025-06-23
Patch available
A vendor patch is available. No clean upgrade release — apply the published patch.
See remediation →
95/100
Remediation priority · Urgent
Zero-click Patch available

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Improper Link Resolution Before File Access ('Link Following') vulnerability in yrutschle sslh.This issue affects sslh: before 2.2.2.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis
How this class of weakness works · CWE-59

A file operation follows a symbolic link without checking where it actually points, so an attacker who can plant or swap a link redirects the operation to a file they should not be able to touch. It is a common local privilege-escalation primitive. Remediation is resolving and validating the real target path, and avoiding operations on attacker-controllable links.

General guidance for the link following (symlink) class — the official description and references above are authoritative for this specific CVE. Want a bespoke review and a reviewed fix? Ask our team →

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
Low
Authentication
Y
User interaction
None
Scope
N

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Patch available Apply the vendor patch
Vendor patch github.com →
Recommended fix High confidence

sslh version 2.2.2 or later

  1. 1. Check the current installed version of sslh using: `sslh --version` or your system's package manager (e.g., `dpkg -l sslh`, `rpm -qi sslh`)
  2. 2. If running a version before 2.2.2, upgrade sslh to version 2.2.2 or later
  3. 3. For Debian/Ubuntu: `sudo apt-get update && sudo apt-get install sslh` (ensure the repository provides 2.2.2+)
  4. 4. For other distributions: download from https://github.com/yrutschle/sslh/releases or use the package manager after ensuring the updated package is available
  5. 5. After upgrade, restart the sslh service: `sudo systemctl restart sslh` or `sudo service sslh restart`
  6. 6. Verify the new version is running: `sslh --version`
Caveat Review sslh configuration for any deprecated options between your current version and 2.2.2; some distributions may ship older versions so verify the exact version installed

Generated from the published advisory — verify against the referenced sources before acting.

We can apply and verify the patch for your build — typical engagement from $2,300. Get the patch applied

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-52936 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-52936 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data