CVE-2026-22767
Symlink Following Vulnerability in Dell AppSync 4.6.0 Enables Data Tampering
Publication date: 2026-04-01
Last updated on: 2026-04-02
Assigner: Dell
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dell | appsync | From 4.6.0.0 (inc) to 4.6.1.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-61 | The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Dell AppSync 4.6.0 allows a low privileged local attacker to exploit a UNIX Symbolic Link Following issue, potentially leading to information tampering.
Information tampering can impact the integrity of data, which is a critical aspect of compliance with standards such as GDPR and HIPAA that require protection of data integrity and confidentiality.
Therefore, exploitation of this vulnerability could lead to non-compliance with these regulations due to compromised data integrity and potential unauthorized modification of sensitive information.
Can you explain this vulnerability to me?
Dell AppSync version 4.6.0 contains a UNIX Symbolic Link (Symlink) Following vulnerability. This means that a low privileged attacker with local access to the system could exploit the way the software handles symbolic links.
By exploiting this vulnerability, the attacker could manipulate symbolic links to cause unintended behavior in the application.
How can this vulnerability impact me? :
Exploitation of this vulnerability could lead to information tampering, meaning an attacker could alter data or files that the application accesses or manages.
Because the attacker requires only low privileged local access, this could allow unauthorized modification of information, potentially compromising data integrity.