Back Linuxsecurity

Oracle Bubblewrap Fixes Symlink Path Traversal Vulnerability

Linuxsecurity •LinuxSecurity Advisories • October 21, 2026

Running self-managed GitLab? Critical flaws could allow server code execution. Check the fixes. ×

[0.6.3-1.1] - Fix CVE-2026-87766 path traversal through symlinked mount targets - Use O_PATH for parent directory traversal during setup - Resolves: RHEL-256871

bubblewrap-0.6.3-1.el9_8.1.x86_64.rpm

bubblewrap-0.6.3-1.el9_8.1.aarch64.rpm

Related CVEs: CVE-2026-87766

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Oracle Bubblewrap Vulnerability Fixes Address Path Traversal Flaw Oracle has released multiple updates for its Bubblewrap tool to address a path traversal vulnerability identified as CVE-2026-87766. This flaw affects self-managed GitLab installations, potentially allowing unauthorized server code execution. The vulnerability was published on September 9, 2026, with a CVSS score of 8.8, categorizing it as high severity. The updates include versions 0.6.3-1.1 for Oracle Linux 9, 0.10.0-5 for Oracle Linux 10, and 0.4.0-3 for Oracle Linux 8. Administrators are urged to apply these patches immediately to mitigate risks. The vulnerability is associated with symlinked mount targets and improper directory traversal during setup, making it for users to update their systems promptly. 3 sources 61

Extracted Entities

Oracle Bubblewrap Fixes Symlink Path Traversal Vulnerability

The full story

Extracted Entities

CVEs (1)

CWE Weaknesses (1)

Platforms (1)

Vulnerabilities (1)