CVE-2023-26088

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In Malwarebytes before 4.5.23, a symbolic link may be used delete any arbitrary file on the system by exploiting the local quarantine system. It can also lead to privilege escalation in certain scenarios.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://support.malwarebytes.com/hc/en-us/articles/14279575968659-Malwarebytes-for-Windows-4-5-23-Release-NotesRelease Notes
https://www.malwarebytes.com/secure/cves/cve-2023-26088Vendor Advisory
https://support.malwarebytes.com/hc/en-us/articles/14279575968659-Malwarebytes-for-Windows-4-5-23-Release-NotesRelease Notes
https://www.malwarebytes.com/secure/cves/cve-2023-26088Vendor Advisory

Timeline

Published: Mar 23, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-260899.8European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing. Th CVE-2023-26095.5NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1531.CVE-2023-260916.1The frp_form_answers (aka Forms Export) extension before 3.1.2, and 4.x before 4.0.2, for TYPO3 allows XSS via saved emails.CVE-2023-260929.8Liima before 1.17.28 allows server-side template injection.CVE-2023-260939.8Liima before 1.17.28 allows Hibernate query language (HQL) injection, related to colToSort in the deployment filter.CVE-2023-260957.5ASQ in Stormshield Network Security (SNS) 4.3.15 before 4.3.16 and 4.6.x before 4.6.3 allows a crash when analysing a crafted SIP packet.CVE-2023-260975.5An issue was discovered in Telindus Apsal 3.14.2022.235 b. Unauthorized actions that could modify the application behaviour may not be block CVE-2023-260987.8An issue was discovered in the Open Document feature in Telindus Apsal 3.14.2022.235 b. An attacker may upload a crafted file to execute arb CVE-2023-260997.1An issue was discovered in Telindus Apsal 3.14.2022.235 b. The consultation permission is insecure.CVE-2023-26107.8Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1532.CVE-2023-261006.1In Progress Flowmon before 12.2.0, an application endpoint failed to sanitize user-supplied input. A threat actor could leverage a reflected CVE-2023-261017.5In Progress Flowmon Packet Investigator before 12.1.0, a Flowmon user with access to Flowmon Packet Investigator could leverage a path-trave