CVE-2008-4998: postinst in twiki 4.1.2 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/tw...

Security readout for executives and security teams

This is a historical, disputed report about Twiki 4.1.2 packaging. The claim is that a local user could abuse a temporary file used during package installation to overwrite another file. It is not described as remote, internet-exposed, or actively exploited in the provided sources. Exposure appears limited to legacy systems installing or upgrading Twiki 4.1.2 where untrusted local users exist. The affected-product metadata is incomplete, and the vendor dispute makes practical exposure uncertain. Do not treat this as an emergency based on the supplied evidence. Prioritize verification only if the organization still runs legacy Twiki 4.1.2 packages on shared systems with local users. Mitigation focus: Check Twiki and distribution guidance before treating this as confirmed.; Prefer maintained Twiki packages from supported repositories.; Avoid legacy Twiki 4.1.2 package maintenance on shared multi-user hosts..

Prepared

Jun 28, 2026, 18:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.