What is GHSA-qm7h-f635-h2r6?

GHSA-qm7h-f635-h2r6 is a security advisory published by GitHub Security Advisories with High severity. Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on...

Which CVE IDs does GHSA-qm7h-f635-h2r6 cover?

GHSA-qm7h-f635-h2r6 covers the following CVE IDs: CVE-2026-61371. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qm7h-f635-h2r6?

GHSA-qm7h-f635-h2r6 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-qm7h-f635-h2r6HighCVSS 7.5

Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on...

Vendor

GitHub Security Advisories

Published

July 15, 2026

Last Modified

July 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-61371 →

📋 Description

Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The destructive effect is performed at open-time via O_TRUNC, and can happen before full input validation completes (“truncation-before-validation”).

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-61371
https://github.com/microsoft/avml/pull/754
https://gist.github.com/thesmartshadow/2d099071f847de8db3dc4bbaf4dfa6df
https://github.com/microsoft/avml/releases/tag/v0.17.0
https://github.com/advisories/GHSA-qm7h-f635-h2r6