A vulnerable symbolic link handling in the Juniper Junos OS command line interface permits a local authenticated user with low privileges to exploit a symlink following flaw. The attacker can invoke a "file link" command, then another unrelated configuration commit by a different user causes the original user to become able to authenticate as root, effectively escalating privileges. This flaw is categorized as CWE‑61: Improper Restriction of Operations within a Pathname.

The affected product is Juniper Networks Junos OS. All releases prior to 23.2R2‑S7, all 23.4 releases before 23.4R2‑S6, all 24.2 releases before 24.2R2‑S3, all 24.4 releases before 24.4R2‑S2, and all 25.2 releases before 25.2R2 are impacted. Version 25.4R1 and later do not contain the vulnerability.

The CVSS v3 score is 7.0, indicating high severity. EPSS information is not available, and the vulnerability is not listed in CISA KEV, meaning no known public exploitation is documented. The flaw requires local access with a low‑privileged account and the ability to perform a "file link" operation; once logged in, the attacker can trigger a session takeover and obtain root. Given the high impact of compromising the entire system and the lack of defensive measures beyond patching, the risk is significant.