Symlink Following Allows Arbitrary File Overwrite in Webpros SolusVM

An insufficient check allowed for the overwrite of arbitrary files via a symlink.

• Webpros SolusVM 1 in KVM-based deployments: the vendor advisory states that all current versions are affected and identifies 1.30.15 as the patched version.
• The CNA affected data records semver 0 through less than 1.30.15 as affected, with defaultStatus set to unaffected.
• The stable-branch and mainline-branch release notes both record 1.30.15 as a security-hardening release associated with the reported issue.
• The sources do not provide a separate build-by-build list beyond the stated boundary. The status of branches or builds not separately confirmed by the vendor should not be inferred solely from the existence of a fix in one branch.

Webpros SolusVM contains a CWE-59 improper link resolution flaw in which an insufficient check before file access allows a write operation to follow a symlink. The confirmed result is arbitrary file overwrite. The vendor identifies KVM-based SolusVM 1 deployments as the relevant scope and describes possible unauthorized privilege escalation to the host node.

The supplied attack characteristics indicate network reachability, low privileges, no user interaction, and low complexity. The available sources do not disclose the file-handling endpoint, exact component, file paths, input format, or the conditions required to create and control the symlink. Do not infer that every file-writing operation or every SolusVM configuration has the same exposure.

The flaw is network-reachable and requires a low-privilege context; no user interaction is required, and the recorded attack characteristics indicate low complexity. The Webpros advisory describes conditions that could allow unauthorized privilege escalation from a guest to the host node.

The supplied record does not identify a public exploit, and the returned vulnerability data records exploitation as none. That status is limited by its scope and time and does not prove that exploitation is impossible. The precise precondition for controlling a symlink or selecting the destination file has not been published.

The flaw permits arbitrary file overwrite through a symlink and, under the relevant conditions, may enable privilege escalation from a guest to the host node. Host access could expand the impact from one virtual server to services or other virtual servers on the same node.

Realistic consequences may include modification of management files, service disruption, or further host compromise, but the target files and specific post-exploitation capabilities have not been disclosed. The record does not describe a breach, victim, or specific exploitation activity, so the potential impact must not be treated as evidence that an incident occurred.

• Multi-tenant risk: Unauthorized access to a host node could affect the security and stability of other virtual servers sharing that node.
• System integrity: Arbitrary file overwrite may permit changes to host-managed files or configuration files, although the specific target files are not identified.
• Service disruption: If an overwritten file is used by a service or management component, the result could be malfunction or outage; this is a possible consequence, not a confirmed incident.
• Investigation scope: The advisory does not name a breach, victim, or campaign, so it does not establish that data disclosure or service loss has occurred.

1. Upgrade KVM-based SolusVM 1 deployments to the vendor-identified patched release 1.30.15. The vendor advisory instructs administrators to use 1.30.15 or later and to verify the installed version after updating.
2. Check the management node and every KVM node separately because the advisory describes exposure across management and node components.
3. Confirm the actual installed version on each system rather than relying only on the master version or a successful update status.
4. Assess host nodes that ran an affected version for unauthorized file or configuration changes after upgrading. The reviewed sources do not document a specific temporary mitigation, so guest-access restrictions or filesystem monitoring should not be treated as a vendor-confirmed fix.

1. Inventory every KVM-based SolusVM 1 deployment, including the management node and each virtualization node.
2. Check the installed version on every master and node, then compare it with the patched release identified by Webpros. Versions below that release require remediation.
3. Review audit records, administrative activity, and host-file integrity for unexpected changes while an affected build was deployed. This is precautionary review, not a vendor-confirmed indicator.
4. If unauthorized changes are found, preserve relevant logs and evidence before restoration or upgrade. The available sources do not name a specific endpoint, path, log event, or IOC; absence of anomalous log evidence does not establish safety.