A local privilege escalation flaw was found in the QEMU guest agent (qemu-guest-agent). The guest-ssh-add-authorized-keys command follows symbolic links while operating on a user's ~/.ssh/authorized_keys file, allowing a local unprivileged user in the guest to leverage a symlink attack (CWE-61) to escalate privileges.