AIKIDO-2026-115554

TL;DR

chmod skips its symlink guard when the mode comes from --reference, so recursive (-R) traversal follows those links. A local user who can write into a traversed subdirectory can plant symlinks that redirect the privileged permission change to files outside the intended tree, widening permissions on sensitive files and enabling local privilege escalation. The fix checks the symlink guard before selecting the mode so recursion does not follow symlinks.