Description

In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorized_keys file to be a symlink. NOTE: FreedomBox is a Debian Pure Blend, which means that it distributes its software through Debian repositories.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-11-06T17:17:25.483Z",
  "pubdate": "2026-11-06T17:17:25.483Z",
  "executiveSummary": "A critical file system permission vulnerability exists in FreedomBox versions prior to 26.15, allowing unprivileged local users to perform unauthorized file read and write operations.\nThe vulnerability stems from improper handling of symbolic links when interacting with the authorized_keys file, effectively bypassing standard discretionary access control (DAC) mechanisms.\nThis flaw allows an attacker with a local unprivileged account to escalate their capability to read sensitive configuration files or overwrite arbitrary files on the filesystem, potentially leading to full system compromise or persistence.\nThe risk is categorized as high for multi-user environments where trust between local users is not absolute. The primary exploitation requirement is the ability to execute commands as an unprivileged user on the target system. No network-level access is required, as the exploit is locally triggered through the manipulation of file system objects.\nUsers are strongly advised to update to version 26.15 or later to remediate the underlying file handling logic.",
  "technicalDetails": "The vulnerability resides in the way FreedomBox manages user-specific SSH configurations, specifically the authorized_keys file. In versions prior to 26.15, the application fails to validate the target of a file path before performing file operations. An unprivileged user can create a symbolic link pointing to a critical system file (e.g., /etc/shadow or other sensitive configuration files) and place this symlink at the location where the system expects the authorized_keys file to reside.\nWhen the affected FreedomBox component performs a write operation or a management function on the authorized_keys file, it follows the symbolic link without verifying if the target file resides outside the user's home directory or if the user has legitimate write access to the target.\nThe attack flow proceeds as follows: 1) The unprivileged attacker identifies a location where FreedomBox writes or manages the authorized_keys file. 2) The attacker removes or replaces the existing authorized_keys file with a symbolic link directed toward a sensitive target file elsewhere in the system. 3) The attacker triggers the FreedomBox process or script that interacts with the authorized_keys file. 4) The process, executing with elevated privileges (or simply lacking symlink resolution checks), follows the link and writes content to or reads content from the target file, depending on the operation.\nThis exploitation technique effectively grants the user the privileges of the service performing the file operation, leading to a complete breakdown of file system permissions. Because FreedomBox operates as a Debian Pure Blend, this vulnerability impacts users deploying these packages via Debian repositories, necessitating a package update to sanitize the file handling procedures. The root cause is an insecure assumption regarding the integrity of the user-controlled file path, specifically failing to account for symlink-based redirection in a multi-user environment. Post-exploitation, an attacker can modify root-owned files to insert backdoors, change user passwords, or manipulate system configuration, resulting in total loss of confidentiality, integrity, and availability."
}