CVE-2007-4998: cp, when running with an option to preserve symlinks on multiple OSes, allows local, user-assisted attacker...

Security readout for executives and security teams

This is a local file overwrite issue in cp when used with symlink-preserving options on crafted directory trees. It requires attacker-controlled copied content and someone or some privileged process to perform the copy. Business risk is mainly to build, packaging, backup, or administrative workflows that copy untrusted directories with elevated privileges. Exposure is most likely in local shell scripts, installers, build systems, backups, or admin procedures that run cp with symlink preservation against untrusted or user-writable directory trees. Treat as targeted operational risk, not an internet-facing emergency. Prioritize review where privileged automation handles untrusted files, because impact could include overwriting sensitive local files. Mitigation focus: Check OS and package vendor advisories for cp updates or backported fixes.; Avoid symlink-preserving copies from untrusted or user-writable source trees.; Run copy workflows with the least privileges required..

Prepared

Jun 28, 2026, 19:27 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.