Hello! I’m following up on the vulnerability report I sent on May 2nd regarding a Security Vulnerability; *znew -P symlink file overwrite in gzip 1.14*.
I wanted to confirm that it was received and see if there are any updates on your review. Please let me know if you need any additional details or clarification from my side. Thank you for your time. Regards, Yazdan Soltani @Cyberlancer On Sat, May 2, 2026 at 11:29 PM Yazdan Soltani <[email protected]> wrote: > Hello! > > I am reporting a potential local file-clobbering issue in znew -P in gzip > 1.14. > > In my testing, znew -P follows a pre-existing .gz symlink and overwrites > the symlink target as the znew caller. When znew -P is executed by root in > an attacker-writable directory, this can result in a root-owned file being > overwritten. > This is not standalone RCE or direct privilege escalation. The impact is > privileged file overwrite/file corruption when znew -P is used by > privileged automation or another privileged user in a directory where an > attacker can create the derived .gz symlink. > > I have attached a report with the affected line, proof of concept, > expected/actual results, and related historical context. > > If the maintainers consider this behavior a currently valid security issue > rather than already fully covered by the historical znew symlink CVEs, > could you advise whether a new CVE should be requested for this gzip 1.14 > issue? > > > Regards, > Yazdan Soltani >
