GHSA-WX3M-WHQV-XV47: GHSA-WX3M-WHQV-XV47: Multiple Path Traversal and Symlink-Following Vulnerabilities in skillctl

#security #cve #cybersecurity #ghsa

GHSA-WX3M-WHQV-XV47: Multiple Path Traversal and Symlink-Following Vulnerabilities in skillctl

Vulnerability ID: GHSA-WX3M-WHQV-XV47
CVSS Score: 7.5
Published: 2026-06-05

An analysis of four critical vulnerabilities in the skillctl Rust crate (versions 0.1.0 and 0.1.1) that allow arbitrary file exfiltration and directory deletion.

TL;DR

A cluster of path-safety flaws in skillctl allows attackers to exfiltrate local files via symbolic links and delete arbitrary directories using manipulated path configurations.

Technical Details

CWE ID: CWE-22, CWE-61
Attack Vector: Local, via malicious remote repository or pull request configurations
CVSS Severity: High (7.5)
Exploit Status: none
KEV Status: not listed

Affected Systems

skillctl
skillctl: >= 0.1.0, <= 0.1.1 (Fixed in: 0.1.2)

Code Analysis

Commit: 827fff5

Implement lexical path safety validation and refuse symbolic links during recursive directory copies

Mitigation Strategies

Upgrade skillctl to version 0.1.2 or later
Audit local .skills.toml configurations for absolute paths or directory traversals
Scan for unauthorized symbolic links inside skill paths

Remediation Steps:

Run cargo install skillctl --force to upgrade the CLI globally.
Inspect and clean existing .skills.toml files within local workspaces.
Analyze repository dependencies and require skillctl >= 0.1.2 in Cargo.toml configurations.

References

Read the full report for GHSA-WX3M-WHQV-XV47 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community