CVE-2026-120066
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
26/100
Published: 2026-11-02
Modified: 2026-11-02
First seen: 2026-11-02
Status: active
Attack Surface
No Interaction
Conf. Impact
CVSS Vector Breakdown
AV:
Local
AC:
High
PR:
Low
UI:
None
S:
Unchanged
C:
High
I:
Low
A:
None
Description
On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read query text and data from another user's logs, and can place a symbolic link at the predictable path so that the driver appends log data to a file of the attacker's choosing with the victim's privileges. Versions before psqlODBC 18.00.0006 are affected.
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| PostgreSQL | psqlODBC | 0 < 18.00.0006 |
| PostgreSQL | psqlODBC | 0 < 18.00.0006 |