CVE-2026-6851

HighCVSS 7.0/10Last modified Aug 12, 2026

Description

An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in Bitdefender Total Security and Internet Security on Windows allows a less-privileged local user to elevate rights by leveraging a race conditions via Symbolic Links.

This issue affects Total Security: before 27.0.58.315; Internet Security: before 27.0.58.315.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Vendor	Product	Versions
Bitdefender	Total Security	< 27.0.58.315
Bitdefender	Internet Security	< 27.0.58.315

References

https://www.bitdefender.com/support/security-advisories/improper-link-resolution-before-file-access-via-link-following-va-13681Broken Link

Timeline

Published: Jul 14, 2026
Last modified: Aug 12, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-685116.3Paaster is a pastebin application. Prior to version 3.3.0, Paaster's "view once" (burn-after-reading) paste mode can be bypassed with concur CVE-2026-685126.3Paaster is a pastebin application. Prior to version 3.3.0, Paaster's account login has no rate limiting, lockout, or CAPTCHA of any kind, an CVE-2026-685137.1OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions 3.3 CVE-2026-685145.5OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In vers CVE-2026-685157.1OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions CVE-2026-685166.5OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version CVE-2026-685176.5Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_a CVE-2026-685188.8Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, _sanitize_mustache_dict() in glances/actions.py sanitizes i CVE-2026-685197.1Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disabl CVE-2026-685205.3Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option na CVE-2026-685237.5`fulgur` converts untrusted HTML/CSS into PDF, commonly on a server that processes input supplied by many tenants. In versions prior to 0.19 CVE-2026-685247.5An unauthenticated attacker can exploit temporary-file handling, access an open file descriptor, and inject a "file:" URI to cause OFBiz to