A vulnerability in the Pack Git import feature of Cribl Stream allows authenticated attackers to manipulate symbolic links, posing a significant risk to system integrity.

The software fails to properly validate symbolic links during the Pack Git import process. This flaw requires the attacker to have low-level privileges to initiate the import and interact with the vulnerable function.

The exploitation of this vulnerability could lead to unauthorized file access or modification, potentially compromising the integrity of the host system. With a CVSS score of 8.8, the risk is classified as High, reflecting the potential for significant technical impact despite the requirement for authenticated access.

Immediate Action: Upgrade all instances of Cribl Stream to version 4.18.2 or higher to fully resolve the underlying symbolic link validation flaw.

Proactive Monitoring: Review system logs for unauthorized file access attempts or suspicious activity originating from the Pack Git import module.

Compensating Controls: Ensure that the service account running Cribl Stream operates with the principle of least privilege to restrict the potential scope of file system access.

Public Exploit Available: No

Given the High severity rating and the potential for total technical impact, organizations should prioritize patching their Cribl Stream deployments. Upgrading to version 4.18.2 is the only definitive method to remediate this vulnerability and protect the environment from potential abuse.