{"cve":"CVE-2024-29069","nvd":{"published":"2024-07-25T20:15:04.483","modified":"2026-06-17T07:22:21.740","status":"Modified","description":"In snapd versions prior to 2.62, snapd failed to properly check the\ndestination of symbolic links when extracting a snap. The snap format \nis a squashfs file-system image and so can contain symbolic links and\nother file types. Various file entries within the snap squashfs image\n(such as icons and desktop files etc) are directly read by snapd when\nit is extracted. An attacker who could convince a user to install a\nmalicious snap which contained symbolic links at these paths could then \ncause snapd to write out the contents of the symbolic link destination\ninto a world-readable directory. This in-turn could allow an unprivileged\nuser to gain access to privileged information.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","score":7.3},"cwes":["CWE-59","CWE-610"],"references":["https://github.com/snapcore/snapd/pull/13682","https://github.com/snapcore/snapd/pull/13682"],"products":["canonical:snapd"],"source":"nvd","synced_at":"2026-10-19T21:52:42.518321223+00:00"},"epss":{"cve":"CVE-2024-29069","score":0.00228,"percentile":0.13624,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-69p6-gp5x-j269","url":"https://osv.dev/vulnerability/GHSA-69p6-gp5x-j269","summary":"snapd failed to properly check the destination of symbolic links when extracting a snap","modified":"2026-09-10T03:50:16.297974820Z","packages":[{"ecosystem":"Go","name":"github.com/snapcore/snapd","purl":"pkg:golang/github.com/snapcore/snapd","ranges":["<2.62"],"fixed":["2.62"]}]},{"id":"GO-2024-3009","url":"https://osv.dev/vulnerability/GO-2024-3009","summary":"snapd failed to properly check the destination of symbolic links when extracting a snap in github.com/snapcore/snapd","modified":"2024-08-06T22:27:07.749015Z","packages":[{"ecosystem":"Go","name":"github.com/snapcore/snapd","purl":"pkg:golang/github.com/snapcore/snapd","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}