Weaknesses of type CWE-59

823 results

Seguimento inseguro de links simbólicos

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o destino é legítimo, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo com privilégio elevado que acessa `/tmp/arquivo` pode ser redirecionado por um symlink malicioso para ler ou modificar `/etc/passwd`, por exemplo.

Example

Um script root copia logs da aplicação de `/tmp/app.log` para `/var/log/backup.log`. Um atacante cria um symlink `/tmp/app.log` → `/etc/shadow` e aguarda a execução do script; o arquivo sensível é então copiado e exposto.

How to mitigate

Use APIs seguras como `O_NOFOLLOW` (em open/openat) ou `lstat()` para detectar symlinks antes de operar. Valide o proprietário e permissões de arquivos alvo, e armazene arquivos temporários em diretórios privados (não `/tmp`), com umask restritivo.

CVE-2026-14891HIGHNomad vulnerable to sandbox escape in Docker task driverEPSS 0.5%CVE-2020-14367—A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. The file is created during chrEPSS 0.5%CVE-2023-32053HIGHWindows Installer Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-20941HIGHHost Process for Windows Tasks Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2019-18898HIGHtrousers: Local privilege escalation from tss to rootEPSS 0.5%CVE-2025-49680HIGHWindows Performance Recorder (WPR) Denial of Service VulnerabilityEPSS 0.5%CVE-2026-63293CRITICALArbitrary File Read/Write: metadata.yaml symlink in image allows host filesystem access as rootEPSS 0.5%CVE-2026-44051HIGHArbitrary file read via attacker-controlled symlink creationEPSS 0.5%CVE-2026-85583HIGHSiYuan before v3.8.2 Path Traversal via symlink in file APIEPSS 0.5%CVE-2020-2026HIGHKata Containers - Guests can trick the kata-runtime into mounting the container image on any host pathEPSS 0.5%CVE-2026-58403MEDIUMHugo symlink confinement bypass in os.ReadFileEPSS 0.5%CVE-2024-52050HIGHA LogServer arbitrary file creation vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected inEPSS 0.5%CVE-2026-2808MEDIUMConsul vulnerable to arbitrary file reads through the vault kubernetes authentication providerEPSS 0.5%CVE-2024-23459HIGHMultiple Arbitrary Creates/Overwrites by link followingEPSS 0.5%CVE-2026-52811CRITICALGogs: UploadRepoFiles writes outside repo working tree via committed parent symEPSS 0.5%CVE-2026-72971MEDIUMWindows Container Isolation FS Filter Driver (unionfs.sys) Tampering VulnerabilityEPSS 0.5%CVE-2026-49176HIGHWindows WalletService Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-41397HIGHOpenClaw < 2026.3.31 - Sandbox Escape via Unrestricted File Sync and Symlink TraversalEPSS 0.5%CVE-2026-50364HIGHWindows Backup Service Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2023-24930HIGHMicrosoft OneDrive for MacOS Elevation of Privilege VulnerabilityEPSS 0.5%