CVE-2024-29069
snapd will follow archived symlinks when unpacking a filesystem
In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image (such as icons and desktop files etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained symbolic links at these paths could then cause snapd to write out the contents of the symbolic link destination into a world-readable directory. This in-turn could allow an unprivileged user to gain access to privileged information.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
snapd will follow archived symlinks when unpacking a filesystem
In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image (such as icons and desktop files etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained symbolic links at these paths could then cause snapd to write out the contents of the symbolic link destination into a world-readable directory. This in-turn could allow an unprivileged user to gain access to privileged information.
- Record
CVE-2024-29069- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-610
- Updated
- 2026-11-02
EUVDEUVD-2024-2278
In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image (such as icons and desktop files etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained symbolic links at these paths could then cause snapd to write out the contents of the symbolic link destination into a world-readable directory. This in-turn could allow an unprivileged user to gain access to privileged information.
- Record
EUVD-2024-2278- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-69p6-gp5x-j269
snapd failed to properly check the destination of symbolic links when extracting a snap
In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image (such as icons and desktop files etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained symbolic links at these paths could then cause snapd to write out the contents of the symbolic link destination into a world-readable directory. This in-turn could allow an unprivileged user to gain access to privileged information.
- Record
GHSA-69p6-gp5x-j269- CVSS 4.0
- 2.4 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-59, CWE-610
- Updated
- 2026-11-02
NVD
In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image (such as icons and desktop files etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained symbolic links at these paths could then cause snapd to write out the contents of the symbolic link destination into a world-readable directory. This in-turn could allow an unprivileged user to gain access to privileged information.
- Record
CVE-2024-29069- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-610, CWE-59
- Updated
- 2026-11-02
OSV
snapd will follow archived symlinks when unpacking a filesystem
In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image (such as icons and desktop files etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained symbolic links at these paths could then cause snapd to write out the contents of the symbolic link destination into a world-readable directory. This in-turn could allow an unprivileged user to gain access to privileged information.
- Record
CVE-2024-29069- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-610
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-29069
In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image (such as icons and desktop files etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained symbolic links at these paths could then cause snapd to write out the contents of the symbolic link destination into a world-readable directory. This in-turn could allow an unprivileged user to gain access to privileged information.
- Record
DEBIAN-CVE-2024-29069- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVGHSA-69p6-gp5x-j269
snapd failed to properly check the destination of symbolic links when extracting a snap
In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image (such as icons and desktop files etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained symbolic links at these paths could then cause snapd to write out the contents of the symbolic link destination into a world-readable directory. This in-turn could allow an unprivileged user to gain access to privileged information.
- Record
GHSA-69p6-gp5x-j269- CVSS 4.0
- 2.4 Low
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-59, CWE-610
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-29069
In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image (such as icons and desktop files etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained symbolic links at these paths could then cause snapd to write out the contents of the symbolic link destination into a world-readable directory. This in-turn could allow an unprivileged user to gain access to privileged information.
- Record
UBUNTU-CVE-2024-29069- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L - CVSS 3.1
- 7.3 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGO-2024-3009 No score
snapd failed to properly check the destination of symbolic links when extracting a snap in github.com/snapcore/snapd
snapd failed to properly check the destination of symbolic links when extracting a snap in github.com/snapcore/snapd.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/snapcore/snapd before v2.62.0.
- Record
GO-2024-3009- Updated
- 2026-11-02
OSVUSN-6940-1 No score
snapd vulnerabilities
Neil McPhail discovered that snapd did not properly restrict writes to the $HOME/bin path in the AppArmor profile for snaps using the home plug. An attacker who could convince a user to install a malicious snap could use this vulnerability to escape the snap sandbox. (CVE-2024-1724)
Zeyad Gouda discovered that snapd failed to properly check the file type when extracting a snap. An attacker who could convince a user to install a malicious snap containing non-regular files could then cause snapd to block indefinitely while trying to read from such files and cause a denial of service. (CVE-2024-29068)
Zeyad Gouda discovered that snapd failed to properly check the destination of symbolic links when extracting a snap. An attacker who could convince a user to install a malicious snap containing crafted symbolic links could then cause snapd to write out the contents of the symbolic link destination into a world-readable directory. This in-turn could allow a local unprivileged user to gain access to privileged information. (CVE-2024-29069)
- Record
USN-6940-1- Updated
- 2026-11-02
OSVUSN-6940-2 No score
snapd vulnerabilities
USN-6940-1 fixed vulnerabilities in snapd. This update provides the corresponding updates for Ubuntu 18.04 LTS and Ubuntu 16.04 LTS.
Original advisory details:
Neil McPhail discovered that snapd did not properly restrict writes to the /home/jslarraz/bin path in the AppArmor profile for snaps using the home plug. An attacker who could convince a user to install a malicious snap could use this vulnerability to escape the snap sandbox. (CVE-2024-1724)
Zeyad Gouda discovered that snapd failed to properly check the file type when extracting a snap. An attacker who could convince a user to install a malicious snap containing non-regular files could then cause snapd to block indefinitely while trying to read from such files and cause a denial of service. (CVE-2024-29068)
Zeyad Gouda discovered that snapd failed to properly check the destination of symbolic links when extracting a snap. An attacker who could convince a user to install a malicious snap containing crafted symbolic links could then cause snapd to write out the contents of the symbolic link destination into a world-readable directory. This in-turn could allow a local unprivileged user to gain access to privileged information. (CVE-2024-29069)
- Record
USN-6940-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/snapcore/snapdGo |
before 2.62 | 2.62 |
snapdDebian:12 |
All versions, plus listed versions 2.57.6-12.57.6-1+deb12u12.59.5-12.60.2-12.61.1-1 Show 32 moreShow less2.61.2-12.61.2-22.62-12.62-22.62-32.62-42.62-52.63-12.63-22.63-32.63-42.65.1-12.65.3-12.66.1-12.66.1-22.67-12.68.3-22.68.3-32.71-12.71-22.71-32.72-12.73-32.73-42.74.1-12.75.2-12.75.2-22.76-12.76.3-12.76.3-22.77.1-12.77.1-2 |
None known |
snapdDebian:13 |
before 2.62-1 | 2.62-1 |
snapdDebian:14 |
before 2.62-1 | 2.62-1 |
github.com/snapcore/snapdGo |
All versions | None known |
snapdUbuntu:Pro:16.04:LTS |
before 2.61.4ubuntu0.16.04.1+esm1, plus listed versions 1.91.9.1.11.9.22.02.0.1 Show 45 moreShow less2.0.22.0.32.0.52.0.82.0.92.0.102.11+0.16.042.12+0.16.042.132.14.2~16.042.15.2ubuntu12.16ubuntu32.17.1ubuntu12.20.1ubuntu12.212.22.22.22.32.22.62.23.12.24.12.252.26.102.27.52.28.52.29.4.22.32.3.22.32.92.33.1ubuntu22.34.22.34.2ubuntu0.12.37.42.37.4ubuntu0.12.382.39.22.39.2ubuntu0.22.402.42.12.45.12.45.1ubuntu0.22.46.12.47.12.482.48.32.54.3+16.04~esm22.54.3+16.04.0ubuntu0.1~esm3 |
2.61.4ubuntu0.16.04.1+esm1 |
snapdUbuntu:Pro:18.04:LTS |
before 2.61.4ubuntu0.18.04.1+esm1, plus listed versions 2.28.5+17.102.29.4.1+18.042.29.4.2+18.042.31.1+18.042.32+18.04~pre5 Show 34 moreShow less2.32+18.04~pre62.32+18.042.32.3.2+18.042.32.5+18.042.32.8+18.042.32.9+18.042.33.1+18.04ubuntu22.34.2+18.042.34.2+18.04.12.37.1+18.042.37.1.1+18.042.37.4+18.042.37.4+18.04.12.38+18.042.39.2+18.042.40+18.042.42.1+18.042.45.1+18.042.45.1+18.04.22.46.1+18.042.47.1+18.042.48+18.042.48.3+18.042.49.2+18.042.51.1+18.042.54.2+18.04ubuntu12.54.3+18.042.54.3+18.04.2ubuntu0.12.54.3+18.04.2ubuntu0.22.55.5+18.042.57.5+18.042.57.5+18.04ubuntu0.12.58+18.042.58+18.04.1 |
2.61.4ubuntu0.18.04.1+esm1 |
snapdUbuntu:20.04:LTS |
before 2.63+20.04ubuntu0.1, plus listed versions 2.41+19.10.12.42.1+20.042.43.3+git1.8109f82.44~pre1+20.042.44+20.04 Show 24 moreShow less2.44.2+20.042.44.3+20.042.45.1+20.042.45.1+20.04.22.46.1+20.042.47.1+20.042.48+20.042.48.3+20.042.49.2+20.042.51.1+20.04ubuntu22.54.2+20.04ubuntu22.54.3+20.042.54.3+20.04.12.54.3+20.04.1ubuntu0.12.54.3+20.04.1ubuntu0.22.54.3+20.04.1ubuntu0.32.55.5+20.042.57.5+20.042.57.5+20.04ubuntu0.12.58+20.042.58+20.04.12.61.3+20.042.62+20.042.63+20.04 |
2.63+20.04ubuntu0.1 |
snapdUbuntu:22.04:LTS |
before 2.63+22.04ubuntu0.1, plus listed versions 2.53+21.10ubuntu12.54.2+22.04ubuntu12.54.2+22.04ubuntu22.54.2+22.04ubuntu32.54.3+git19.g868fc21+22.04 Show 15 moreShow less2.54.3+git26.g360067e+22.042.55.2+22.042.55.2+22.04.12.55.3+22.042.55.3+22.04ubuntu12.55.5+22.042.56.2+22.04ubuntu12.57.4+22.042.57.5+22.042.57.5+22.04ubuntu0.12.58+22.042.58+22.04.12.61.3+22.042.62+22.042.63+22.04 |
2.63+22.04ubuntu0.1 |
snapdUbuntu:24.04:LTS |
before 2.63+24.04ubuntu0.1, plus listed versions 2.60.4+23.102.61.3+24.042.62+24.04build12.63+24.04 |
2.63+24.04ubuntu0.1 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
snapdUbuntu:20.04:LTS From an advisory covering 3 CVEs |
before 2.63+20.04ubuntu0.1, plus listed versions 2.41+19.10.12.42.1+20.042.43.3+git1.8109f82.44~pre1+20.042.44+20.04 Show 24 moreShow less2.44.2+20.042.44.3+20.042.45.1+20.042.45.1+20.04.22.46.1+20.042.47.1+20.042.48+20.042.48.3+20.042.49.2+20.042.51.1+20.04ubuntu22.54.2+20.04ubuntu22.54.3+20.042.54.3+20.04.12.54.3+20.04.1ubuntu0.12.54.3+20.04.1ubuntu0.22.54.3+20.04.1ubuntu0.32.55.5+20.042.57.5+20.042.57.5+20.04ubuntu0.12.58+20.042.58+20.04.12.61.3+20.042.62+20.042.63+20.04 |
2.63+20.04ubuntu0.1 |
snapdUbuntu:22.04:LTS From an advisory covering 3 CVEs |
before 2.63+22.04ubuntu0.1, plus listed versions 2.53+21.10ubuntu12.54.2+22.04ubuntu12.54.2+22.04ubuntu22.54.2+22.04ubuntu32.54.3+git19.g868fc21+22.04 Show 15 moreShow less2.54.3+git26.g360067e+22.042.55.2+22.042.55.2+22.04.12.55.3+22.042.55.3+22.04ubuntu12.55.5+22.042.56.2+22.04ubuntu12.57.4+22.042.57.5+22.042.57.5+22.04ubuntu0.12.58+22.042.58+22.04.12.61.3+22.042.62+22.042.63+22.04 |
2.63+22.04ubuntu0.1 |
snapdUbuntu:24.04:LTS From an advisory covering 3 CVEs |
before 2.63+24.04ubuntu0.1, plus listed versions 2.60.4+23.102.61.3+24.042.62+24.04build12.63+24.04 |
2.63+24.04ubuntu0.1 |
snapdUbuntu:Pro:16.04:LTS From an advisory covering 3 CVEs |
before 2.61.4ubuntu0.16.04.1+esm1, plus listed versions 1.91.9.1.11.9.22.02.0.1 Show 45 moreShow less2.0.22.0.32.0.52.0.82.0.92.0.102.11+0.16.042.12+0.16.042.132.14.2~16.042.15.2ubuntu12.16ubuntu32.17.1ubuntu12.20.1ubuntu12.212.22.22.22.32.22.62.23.12.24.12.252.26.102.27.52.28.52.29.4.22.32.3.22.32.92.33.1ubuntu22.34.22.34.2ubuntu0.12.37.42.37.4ubuntu0.12.382.39.22.39.2ubuntu0.22.402.42.12.45.12.45.1ubuntu0.22.46.12.47.12.482.48.32.54.3+16.04~esm22.54.3+16.04.0ubuntu0.1~esm3 |
2.61.4ubuntu0.16.04.1+esm1 |
snapdUbuntu:Pro:18.04:LTS From an advisory covering 3 CVEs |
before 2.61.4ubuntu0.18.04.1+esm1, plus listed versions 2.28.5+17.102.29.4.1+18.042.29.4.2+18.042.31.1+18.042.32+18.04~pre5 Show 34 moreShow less2.32+18.04~pre62.32+18.042.32.3.2+18.042.32.5+18.042.32.8+18.042.32.9+18.042.33.1+18.04ubuntu22.34.2+18.042.34.2+18.04.12.37.1+18.042.37.1.1+18.042.37.4+18.042.37.4+18.04.12.38+18.042.39.2+18.042.40+18.042.42.1+18.042.45.1+18.042.45.1+18.04.22.46.1+18.042.47.1+18.042.48+18.042.48.3+18.042.49.2+18.042.51.1+18.042.54.2+18.04ubuntu12.54.3+18.042.54.3+18.04.2ubuntu0.12.54.3+18.04.2ubuntu0.22.55.5+18.042.57.5+18.042.57.5+18.04ubuntu0.12.58+18.042.58+18.04.1 |
2.61.4ubuntu0.18.04.1+esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-29069 is a medium vulnerability (CVSS 4.8) in Canonical Snapd, published March 14, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.23%, the 13th percentile. Fixed in github.com/snapcore/snapd 2.62.
References
github.com/snapcore/snapd/pull/13682
nvd.nist.gov/vuln/detail/CVE-2024-29069
pkg.go.dev/vuln/GO-2024-3009
Show 8 moreShow less
security-tracker.debian.org/tracker/CVE-2024-29069
ubuntu.com/security/CVE-2024-29069
cve.org/CVERecord?id=CVE-2024-29069
Left out here: 6 versions. The JSON record has them.