GHSA-6XX4-9WP6-65P7: Arbitrary Local File Disclosure via UNIX Symlink Following in skilo
Vulnerability ID: GHSA-6XX4-9WP6-65P7
CVSS Score: 6.5
Published: 2026-07-28
A local file disclosure vulnerability exists in the Rust-based package skilo. When copying files during skill installation, the application recursively traverses directories but dereferences symbolic links, resulting in unauthorized local file reading.
TL;DR
A UNIX symbolic link following vulnerability in skilo's installation routine allows attackers to exfiltrate arbitrary local files readable by the target user.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-59
- Attack Vector: Network
- CVSS Score: 6.5
- EPSS Score: 0.00045
- Impact: Confidentiality (High)
- Exploit Status: poc
- KEV Status: Not Listed
Affected Systems
- skilo
-
skilo: >= 0.5.0, < 0.11.1 (Fixed in:
0.11.1)
Code Analysis
Commit: c14bdc2
Refuse to install skills that contain symlinks to prevent potential exfiltration
diff --git a/src/commands/add.rs b/src/commands/add.rs\nindex fad4954..135a9d0 100644\n--- a/src/commands/add.rs\n+++ b/src/commands/add.rs\n@@ -575,11 +575,19 @@ fn copy_dir_all(src: &Path, dst: &Path) -> Result<(), SkiloError> {\n \n for entry in fs::read_dir(src)? {\n let entry = entry?;\n+ // `file_type()` does not traverse symlinks, so this reports the link\n+ // itself. Refuse symlinks: `fs::copy` would dereference them and copy\n+ // the contents of whatever they point at (potentially files outside the\n+ // skill, such as SSH keys or credentials) into the installed skill.\n let ty = entry.file_type()?;\n let src_path = entry.path();\n let dst_path = dst.join(entry.file_name());\n \n- if ty.is_dir() {\n+ if ty.is_symlink() {\n+ return Err(SkiloError::SymlinkInSkill {\n+ path: src_path.display().to_string(),\n+ });\n+ } else if ty.is_dir() {\n copy_dir_all(&src_path, &dst_path)?;\n } else {\n fs::copy(&src_path, &dst_path)?;
Exploit Details
- GitHub Advisory Database: Advisory page detailing the local file disclosure and official regression test cases serving as a proof of concept.
Mitigation Strategies
- Upgrade skilo to version 0.11.1 or higher
- Audit directories for symbolic links before installation
- Run skilo under a restricted user profile to isolate access
Remediation Steps:
- Verify current skilo version using skilo --version
- Download and compile skilo version 0.11.1
- Replace older binaries with the updated version
References
Read the full report for GHSA-6XX4-9WP6-65P7 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)