Local file read/write via symlink escape

Link following in libfuse SSHFS before 3.7.6 allows remote attackers to read or write local files via malicious SFTP symlink targets. sshfs_readlink() copies server-supplied absolute targets and ../-based relative targets to FUSE unchanged, and transform_symlink() returns early for relative paths, so the client kernel resolves them against the local filesystem. Exploitation requires a victim to mount a rogue or compromised SFTP server and then follow the returned link during normal operations such as cp, rsync, backups, or editing; those actions can exfiltrate readable files or overwrite writable ones, including startup or scheduled-task files.