CVE-2026-75038 Predictable temporary file in /tmp allows symlink attack in LACT
Local attackers can exploit predictable temporary files to perform symlink attacks, causing denial of service in LACT.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-75038?
CVE-2026-75038 is a medium-severity path traversal vulnerability in ilya-zlobintsev LACT, published on 25 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
UNIX symbolic link (symlink) following vulnerability in ilya-zlobintsev/LACT allows for local denial-of-service. This issue affects LACT: through 0.10.0.
Weakness: CWE-61
Which versions are affected by CVE-2026-75038?
How do I fix CVE-2026-75038?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-75038 being exploited?
There is no known exploitation of CVE-2026-75038 in the wild and no public exploit code.
Sources
Also known as GHSA-gcmx-rfrg-443v.