CVE-2026-57203

The record

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `ast_loggrabber` executes a `Python script` from the world-writable `/tmp` directory. An attacker already authorized to open a shell session on the Asterisk server may place a malicious script there and gain elevated privileges or execute code when an administrator runs `ast_loggrabber` as a user with elevated privileges. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected packages

Related vulnerabilities

• CVE-2026-119333 draw.io Desktop is the official Electron build of draw.io. CWE-426
• CVE-2026-116243 pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets… CWE-426
• CVE-2026-105477 A vulnerability in Veeam Agent for Linux allows for local privilege escalation. CWE-426
• CVE-2026-113461 Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to… CWE-426
• CVE-2026-83509 Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to… CWE-426
• CVE-2026-83506 Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate… CWE-426
• CVE-2026-83505 Time-of-check time-of-use (toctou) race condition in Windows Setup Files Cleanup allows… CWE-426
• CVE-2026-70142 Untrusted search path in Windows Update Service allows an authorized attacker to elevate… CWE-426