Weaknesses of type CWE-59

823 results

Seguimento inseguro de links simbólicos

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o destino é legítimo, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo com privilégio elevado que acessa `/tmp/arquivo` pode ser redirecionado por um symlink malicioso para ler ou modificar `/etc/passwd`, por exemplo.

Example

Um script root copia logs da aplicação de `/tmp/app.log` para `/var/log/backup.log`. Um atacante cria um symlink `/tmp/app.log` → `/etc/shadow` e aguarda a execução do script; o arquivo sensível é então copiado e exposto.

How to mitigate

Use APIs seguras como `O_NOFOLLOW` (em open/openat) ou `lstat()` para detectar symlinks antes de operar. Valide o proprietário e permissões de arquivos alvo, e armazene arquivos temporários em diretórios privados (não `/tmp`), com umask restritivo.

CVE-2023-32012HIGHWindows Container Manager Service Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2021-35939—It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of theEPSS 0.5%CVE-2026-63125CRITICALIncus vulnerable to root RCE via image backup.yaml symlinkEPSS 0.5%CVE-2014-1420LOWInsecure temp file usage in Ubuntu UI toolkitEPSS 0.5%CVE-2026-54094HIGHFile Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scopeEPSS 0.5%CVE-2025-59510MEDIUMWindows Routing and Remote Access Service (RRAS) Denial of Service VulnerabilityEPSS 0.5%CVE-2023-35347HIGHMicrosoft Install Service Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2019-3692HIGHLocal privilege escalation from user news to root in the packaging of innEPSS 0.5%CVE-2025-43252MEDIUMThis issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sequoia 15.6. A website may be able tEPSS 0.5%CVE-2024-21397MEDIUMMicrosoft Azure File Sync Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-65647HIGHImproper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.EPSS 0.5%CVE-2020-28935—Local symlink attack in Unbound and NSDEPSS 0.5%CVE-2026-55667HIGHFile Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanupEPSS 0.5%CVE-2023-35342HIGHWindows Image Acquisition Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-54352CRITICALBudibase: Arbitrary file read by workspace-builder via PWA-zip symlink uploadEPSS 0.5%CVE-2024-30060HIGHAzure Monitor Agent Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2024-1753HIGHBuildah: full container escape at build timeEPSS 0.5%CVE-2026-24056MEDIUMpnpm has symlink traversal in file:/git dependenciesEPSS 0.5%CVE-2025-57749MEDIUMn8n has a symlink traversal vulnerability in "Read/Write File" node allows access to restricted filesEPSS 0.5%CVE-2026-81690HIGHverify-usb before 1.4.9 Symlink Directory Traversal Code ExecutionEPSS 0.5%