Weaknesses of type CWE-59

823 results

Seguimento inseguro de links simbólicos

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o destino é legítimo, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo com privilégio elevado que acessa `/tmp/arquivo` pode ser redirecionado por um symlink malicioso para ler ou modificar `/etc/passwd`, por exemplo.

Example

Um script root copia logs da aplicação de `/tmp/app.log` para `/var/log/backup.log`. Um atacante cria um symlink `/tmp/app.log` → `/etc/shadow` e aguarda a execução do script; o arquivo sensível é então copiado e exposto.

How to mitigate

Use APIs seguras como `O_NOFOLLOW` (em open/openat) ou `lstat()` para detectar symlinks antes de operar. Valide o proprietário e permissões de arquivos alvo, e armazene arquivos temporários em diretórios privados (não `/tmp`), com umask restritivo.

CVE-2025-55245HIGHXbox Gaming Services Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-30371LOWMetabase vulnerable to circumvention of local link access protection in GeoJson endpointEPSS 0.4%CVE-2025-68279HIGHWeblate has an arbitrary file read via symbolic linksEPSS 0.4%CVE-2026-50135MEDIUMHugo: Symlink confinement bypass in resources.GetEPSS 0.4%CVE-2026-77815HIGHInfinite Image Browsing Resolves Paths With normpath, Allowing Symlink Escape From Scanned DirectoriesEPSS 0.4%CVE-2020-36657HIGHuptimed before 0.4.6-r1 on Gentoo allows local users (with access to the uptimed user account) to gain root privileges by creating a hard liEPSS 0.4%CVE-2019-3699HIGHLocal privilege escalation from user privoxy to rootEPSS 0.4%CVE-2026-42834HIGHWindows Admin Center in Azure Portal Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-34603HIGH@tinacms/graphql's Media Endpoints Can Escape the Media Root via Symlinks or JunctionsEPSS 0.4%CVE-2026-20310CRITICALCisco SD-WAN Software Security Hardening Release - Improper Link Resolution Before File AccessEPSS 0.4%CVE-2024-7238HIGHVIPRE Advanced Security SBAMSvc Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2025-48820HIGHWindows AppX Deployment Service Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2024-4454HIGHWithSecure Elements Endpoint Protection Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-41882HIGHIn JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible viEPSS 0.4%CVE-2023-27469—Malwarebytes Anti-Exploit 4.4.0.220 is vulnerable to arbitrary file deletion and denial of service via an ALPC message in which FullFileNameEPSS 0.4%CVE-2025-29795HIGHMicrosoft Edge (Chromium-based) Update Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2024-3037HIGHArbitrary File Deletion in PaperCut NG/MF Web PrintEPSS 0.4%CVE-2024-1868HIGHG DATA Total Security Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-61792HIGHWeblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)EPSS 0.4%CVE-2026-47277MEDIUMRuntipi: Unauthenticated arbitrary file read through app-store logo symlinksEPSS 0.4%