Qt QFileSystemEngine Symlink Attack Vulnerability on Windows

A vulnerability in the QFileSystemEngine component of the Qt corelib module on Windows has been identified, allowing for symlink attacks and the use of malicious files. This issue stems from improper link resolution before file access, particularly in how temporary file paths are handled. The vulnerability affects all versions of Qt up to and including 5.15.18, as well as versions 6.0.0 through 6.5.8 and 6.6.0 through 6.8.1. It is caused by the use of the GetTempPath API, which can be exploited to manipulate temporary file paths, potentially leading to unauthorized access and privilege escalation.

Impact

Exploitation of this vulnerability could allow attackers to perform symlink attacks, leading to unauthorized access and privilege escalation by manipulating temporary file paths.

Remediation

Users can upgrade to Qt versions 5.15.19, 6.5.9, 6.8.2, or 6.9.0 to address this vulnerability.