An insecure symlink following vulnerability in Canonical's ubuntu-pro-client utility allows a non-privileged local user to create a symbolic link at a predictable temporary or log directory location that points to any root-readable file. When a system administrator subsequently runs the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and packages the contents into a diagnostic archive. Because that archive remains readable by the attacker, the vulnerable user can retrieve sensitive root-owned files, resulting in a full information disclosure of system secrets. The weakness is a typical path-traversal/unsanitized symlink issue (CWE‑59).

The vulnerability affects Canonical Ubuntu releases from 16.04 LTS through 26.04 LTS as well as the ubuntu-pro-client (formerly ubuntu-advantage-tools) package. Any installed instance that uses the pro collect-logs command is susceptible. No specific version ranges are identified beyond the affected Ubuntu series and the ubuntu-pro-client package.

The reported CVSS score of 5 indicates a medium severity. The EPSS score of < 1% indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in CISA KEV. Exploitation is limited to the local environment and requires that a root administrator later runs the collect‑logs command while a symlink has been placed in a writable location by an unprivileged user. Thus the risk is moderate; if an administrator runs the command without checking the contents of the log directories, the attacker can exfiltrate root files. The attack vector is local, and the attacker must remain on the host.