Weaknesses of type CWE-59

823 results

Seguimento inseguro de links simbólicos

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o destino é legítimo, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo com privilégio elevado que acessa `/tmp/arquivo` pode ser redirecionado por um symlink malicioso para ler ou modificar `/etc/passwd`, por exemplo.

Example

Um script root copia logs da aplicação de `/tmp/app.log` para `/var/log/backup.log`. Um atacante cria um symlink `/tmp/app.log` → `/etc/shadow` e aguarda a execução do script; o arquivo sensível é então copiado e exposto.

How to mitigate

Use APIs seguras como `O_NOFOLLOW` (em open/openat) ou `lstat()` para detectar symlinks antes de operar. Valide o proprietário e permissões de arquivos alvo, e armazene arquivos temporários em diretórios privados (não `/tmp`), com umask restritivo.

CVE-2026-44340HIGHPraisonAI: Symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`EPSS 0.4%CVE-2026-42496CRITICALArchive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directoryEPSS 0.4%CVE-2021-23872HIGHPrivilege Escalation vulnerability in McAfee Total Protection (MTP)EPSS 0.4%CVE-2026-71493MEDIUMInfracost: Arbitrary file read via config-template readFile symlink traversalEPSS 0.4%CVE-2026-15629MEDIUMlouisho5 picobot Workspace filesystem.go GetSkill link followingEPSS 0.4%CVE-2024-49059HIGHMicrosoft Office Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-70348MEDIUMWindows Management Services Denial of Service VulnerabilityEPSS 0.4%CVE-2019-18232—SafeNet Sentinel LDK License Manager, all versions prior to 7.101(only Microsoft Windows versions are affected) is vulnerable when configureEPSS 0.4%CVE-2019-3690MEDIUMchkstat follows untrusted symbolic linksEPSS 0.4%CVE-2019-3694HIGHLocal privilege escalation from munin to root in the packaging of muninEPSS 0.4%CVE-2026-42497HIGHArchive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directoryEPSS 0.4%CVE-2026-44881HIGHPortainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-UpdateEPSS 0.4%CVE-2017-7500HIGHIt was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changinEPSS 0.4%CVE-2025-23010HIGHAn Improper Link Resolution Before File Access ('Link Following') vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client whicEPSS 0.4%CVE-2026-47187CRITICALSSHFS Symlink Escape: Rogue SFTP Server → Local File Read/WriteEPSS 0.4%CVE-2025-0413HIGHParallels Desktop Technical Data Reporter Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2025-55317HIGHMicrosoft AutoUpdate (MAU) Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-90930HIGHFile Browser through 2.63.23 Path Traversal via Symlink AliasEPSS 0.4%CVE-2026-31894MEDIUMWeGIA affected by arbitrary file read via symlink in backup restoreEPSS 0.4%CVE-2025-55245HIGHXbox Gaming Services Elevation of Privilege VulnerabilityEPSS 0.4%