What is GHSA-xj69-cqwc-2w67?

GHSA-xj69-cqwc-2w67 is a security advisory published by GitHub Security Advisories with High severity. Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18...

Which CVE IDs does GHSA-xj69-cqwc-2w67 cover?

GHSA-xj69-cqwc-2w67 covers the following CVE IDs: CVE-2026-56748. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xj69-cqwc-2w67?

GHSA-xj69-cqwc-2w67 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-xj69-cqwc-2w67HighCVSS 8.8

Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18...

Vendor

GitHub Security Advisories

Published

July 27, 2026

Last Modified

July 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-56748 →

📋 Description

Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute arbitrary code as the Cribl server process via a crafted Git repository containing a symbolic link in the pack's functions directory.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-56748
https://docs.cribl.io/stream/release-notes/release-v4182/#security-fixes
https://trust.cribl.io/notifications
https://github.com/advisories/GHSA-xj69-cqwc-2w67