{"uuid": "3ba3d04d-46be-4b4f-b5eb-069e8860c451", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-6xx4-9wp6-65p7", "type": "seen", "source": "https://gist.github.com/alon710/dbe46a55c7d568d0e868122c0cd7642c", "content": "# GHSA-6XX4-9WP6-65P7: GHSA-6XX4-9WP6-65P7: Arbitrary Local File Disclosure via UNIX Symlink Following in skilo\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-07-28\n> **Full Report:** https://cvereports.com/reports/GHSA-6XX4-9WP6-65P7\n\n## Summary\nA local file disclosure vulnerability exists in the Rust-based package skilo. When copying files during skill installation, the application recursively traverses directories but dereferences symbolic links, resulting in unauthorized local file reading.\n\n## TL;DR\nA UNIX symbolic link following vulnerability in skilo's installation routine allows attackers to exfiltrate arbitrary local files readable by the target user.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-59\n- **Attack Vector**: Network\n- **CVSS Score**: 6.5\n- **EPSS Score**: 0.00045\n- **Impact**: Confidentiality (High)\n- **Exploit Status**: poc\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- skilo\n- **skilo**: >= 0.5.0, < 0.11.1 (Fixed in: `0.11.1`)\n\n## Mitigation\n\n- Upgrade skilo to version 0.11.1 or higher\n- Audit directories for symbolic links before installation\n- Run skilo under a restricted user profile to isolate access\n\n**Remediation Steps:**\n1. Verify current skilo version using skilo --version\n2. Download and compile skilo version 0.11.1\n3. Replace older binaries with the updated version\n\n## References\n\n- [GHSA-6XX4-9WP6-65P7 Advisory](https://github.com/advisories/GHSA-6xx4-9wp6-65p7)\n- [Vendor Security Advisory](https://github.com/manuelmauro/skilo/security/advisories/GHSA-6xx4-9wp6-65p7)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-6XX4-9WP6-65P7) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T01:31:18.844380Z"}