Weaknesses of type CWE-59

823 results

Seguimento inseguro de links simbólicos

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o destino é legítimo, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo com privilégio elevado que acessa `/tmp/arquivo` pode ser redirecionado por um symlink malicioso para ler ou modificar `/etc/passwd`, por exemplo.

Example

Um script root copia logs da aplicação de `/tmp/app.log` para `/var/log/backup.log`. Um atacante cria um symlink `/tmp/app.log` → `/etc/shadow` e aguarda a execução do script; o arquivo sensível é então copiado e exposto.

How to mitigate

Use APIs seguras como `O_NOFOLLOW` (em open/openat) ou `lstat()` para detectar symlinks antes de operar. Valide o proprietário e permissões de arquivos alvo, e armazene arquivos temporários em diretórios privados (não `/tmp`), com umask restritivo.

CVE-2013-4392MEDIUMsystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via EPSS 0.5%CVE-2023-42137HIGHPAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow for command execution with high privileEPSS 0.5%CVE-2020-8095MEDIUMBitdefender Total Security Link Resolution Denial-of-Service VulnerabilityEPSS 0.5%CVE-2026-13723MEDIUMDevelar's electron-builder allows arbitrary file overwriteEPSS 0.5%CVE-2026-34242HIGHWeblate: Arbitrary File Read via SymlinkEPSS 0.5%CVE-2023-35320HIGHConnected User Experiences and Telemetry Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-86861MEDIUMpgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment checkEPSS 0.5%CVE-2019-10152HIGHA path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacEPSS 0.5%CVE-2026-33748HIGHBuildKit Git URL subdir component can cause access to restricted filesEPSS 0.5%CVE-2020-15861HIGHNet-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following.EPSS 0.5%CVE-2026-45405CRITICALDokku: Arbitrary File Write via Tar Symlink Traversal in git:from-archive and certs:addEPSS 0.5%CVE-2023-2939HIGHInsufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a local attacker to perform privilege eEPSS 0.5%CVE-2026-59944MEDIUMComposer: CVE-2026-59946 fix bypass via symlinked package bin pathEPSS 0.5%CVE-2026-70460CRITICALrsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir SymlinkEPSS 0.4%CVE-2026-49180MEDIUMUniversal Plug and Play (upnp.dll) Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-29786HIGHnode-tar: Hardlink Path Traversal via Drive-Relative LinkpathEPSS 0.4%CVE-2020-8099HIGHLink Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8387)EPSS 0.4%CVE-2023-36568HIGHMicrosoft Office Click-To-Run Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2008-4996MEDIUMinit in initramfs-tools 0.92f allows local users to overwrite arbitrary files via a symlink attack on the /tmp/initramfs.debug temporary filEPSS 0.4%CVE-2026-87910MEDIUMtarfile hardlink fallback ignores custom extraction filter rejection via NoneEPSS 0.4%