EIP-2026-103002

This exploit leverages a symbolic link vulnerability in liloconfig-color, which insecuresly creates /tmp/reply. An attacker can create a symlink to a critical file (e.g., /etc/passwd) and wait for root to execute the program, resulting in file overwrite.