Improper link resolution before file access ('link following') in Windows Subsystem for Linux (WSL2) allows an authorized local attacker to elevate privileges. This CWE‑59 Symbolic Link Traversal vulnerability arises when the subsystem follows symbolic links without proper validation, enabling access to files or directories that the process runs under a higher privilege level. The flaw can lead to execution of arbitrary code or expansion of the attacker’s capabilities on the host, compromising confidentiality, integrity, and availability.

Microsoft Windows Subsystem for Linux (WSL2) is the affected product. No version information is available from the CNA, so the vulnerability may exist in all current releases until addressed.

With a CVSS score of 7.8, the vulnerability is high severity. Its EPSS score is < 1%, and it is not currently listed in the CISA KEV catalog. The likely attack vector is local; an attacker with legitimate access to the Linux host can exploit the improperly resolved link to elevate privileges. The exploitation requires only that the attacker orchestrate the link traversal, a capability generally available to regular users on the system.