Weaknesses of type CWE-59

823 results

Seguimento inseguro de links simbólicos

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o destino é legítimo, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo com privilégio elevado que acessa `/tmp/arquivo` pode ser redirecionado por um symlink malicioso para ler ou modificar `/etc/passwd`, por exemplo.

Example

Um script root copia logs da aplicação de `/tmp/app.log` para `/var/log/backup.log`. Um atacante cria um symlink `/tmp/app.log` → `/etc/shadow` e aguarda a execução do script; o arquivo sensível é então copiado e exposto.

How to mitigate

Use APIs seguras como `O_NOFOLLOW` (em open/openat) ou `lstat()` para detectar symlinks antes de operar. Valide o proprietário e permissões de arquivos alvo, e armazene arquivos temporários em diretórios privados (não `/tmp`), com umask restritivo.

CVE-2026-81963HIGHWindows Update Stack Elevation of Privilege VulnerabilityEPSS 0.6%KEVCVE-2023-34204MEDIUMimapsync through 2.229 uses predictable paths under /tmp and /var/tmp in its default mode of operation. Both of these are typically world-wrEPSS 0.6%CVE-2023-35379HIGHReliability Analysis Metrics Calculation Engine (RACEng) Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2024-44264HIGHThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS VenturaEPSS 0.6%CVE-2025-25185HIGHGPT Academic allows arbitary file read by tarfile uncompress within softlinkEPSS 0.6%CVE-2023-24904HIGHWindows Installer Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2026-46464MEDIUMDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1EPSS 0.6%CVE-2024-1329HIGHNomad Vulnerable to Arbitrary Write Through Symlink AttackEPSS 0.6%CVE-2024-36306MEDIUMA link following vulnerability in the Trend Micro Apex One and Apex One as a Service Damage Cleanup Engine could allow a local attacker to cEPSS 0.6%CVE-2025-55247HIGH.NET Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2025-25008HIGHWindows Server Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2026-41610MEDIUMVisual Studio Code Security Feature Bypass VulnerabilityEPSS 0.6%CVE-2019-12672MEDIUMCisco IOS XE Software Arbitrary Code Execution VulnerabilityEPSS 0.6%CVE-2025-33075HIGHWindows Installer Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2017-12172—PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runsEPSS 0.6%CVE-2026-71476HIGHNx: Zip-Slip in the self-hosted remote cacheEPSS 0.6%CVE-2023-21678HIGHWindows Print Spooler Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2024-38188HIGHAzure Network Watcher VM Agent Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2024-28907HIGHMicrosoft Brokering File System Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2024-38022HIGHWindows Image Acquisition Elevation of Privilege VulnerabilityEPSS 0.6%