Skip to content
OpenAdvisories
High · 7.1 CVE-2026-59674 EUVD-2026-43633GHSA-j33g-47h2-2687

LPE from suricata user to root due to chown in %post in suricata packaging

Published Jul 14, 2026 · Updated Jul 15, 2026 · Assigned by suse

Description

A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed suricata package allows the suricata user to escalate to root.

This issue affects openSUSE Tumbleweed: from ? before 8.0.5-2.1; openSUSE Tumbleweed: from ? before 8.0.5-2.1.

Affected products

VendorProductAffectedFixed
SUSE openSUSE Tumbleweed ? – < 8.0.5-2.1 8.0.5-2.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
openSUSE Tumbleweed suricata 8.0.5-2.1 openSUSE-SU-2026:11207-1

Advisories 1

References