CVE-2022-26659

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

Docker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any administrator writable files by creating a symlink in place of where the installer writes its log file. Starting from version 4.6.0, the Docker Desktop installer, when run elevated, will write its log files to a location not writable by non-administrator users.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-59

Affected software

No affected versions have been published.

Timeline

Published: Mar 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-26669.8A vulnerability has been found in SourceCodester Loan Management System and classified as critical. This vulnerability affects unknown code CVE-2022-266607.5RunAsSpc 4.0 uses a universal and recoverable encryption key. In possession of a file encrypted by RunAsSpc, an attacker can recover the cre CVE-2022-266616.5An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.CVE-2022-266627.5An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x CVE-2022-266657.5An Insecure Direct Object Reference issue exists in the Tyler Odyssey Portal platform before 17.1.20. This may allow an external party to ac CVE-2022-266669.8Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in HandlerECC.ashx. This allo CVE-2022-266679.8Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in GetDemandAnalysisData CVE-2022-266686.5ASUS Control Center API has a broken access control vulnerability. An unauthenticated remote attacker can call privileged API functions to p CVE-2022-266696.5ASUS Control Center is vulnerable to SQL injection. An authenticated remote attacker with general user privilege can inject SQL command to s CVE-2022-26678.8A vulnerability was found in SourceCodester Loan Management System and classified as critical. This issue affects some unknown processing of CVE-2022-266708.8D-Link DIR-878 has inadequate filtering for special characters in the webpage input field. An unauthenticated LAN attacker can perform comma CVE-2022-266717.3Taiwan Secom Dr.ID Access Control system’s login page has a hard-coded credential in the source code. An unauthenticated remote attacker can