Weaknesses of type CWE-59

823 results

Seguimento inseguro de links simbólicos

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o destino é legítimo, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo com privilégio elevado que acessa `/tmp/arquivo` pode ser redirecionado por um symlink malicioso para ler ou modificar `/etc/passwd`, por exemplo.

Example

Um script root copia logs da aplicação de `/tmp/app.log` para `/var/log/backup.log`. Um atacante cria um symlink `/tmp/app.log` → `/etc/shadow` e aguarda a execução do script; o arquivo sensível é então copiado e exposto.

How to mitigate

Use APIs seguras como `O_NOFOLLOW` (em open/openat) ou `lstat()` para detectar symlinks antes de operar. Valide o proprietário e permissões de arquivos alvo, e armazene arquivos temporários em diretórios privados (não `/tmp`), com umask restritivo.

CVE-2024-30377HIGHG DATA Total Security Scan Server Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2024-1868HIGHG DATA Total Security Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2023-27347HIGHG DATA Total Security Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-53795HIGHrsync < 3.5.0 Arbitrary File Write via --temp-dir/--link-destEPSS 0.4%CVE-2024-6233HIGHCheck Point ZoneAlarm Extreme Security Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2023-42126HIGHG DATA Total Security GDBackupSvc Service Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2023-32050HIGHWindows Installer Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-53793CRITICALrsync < 3.5.0 Path Confinement Bypass via /./ Boundary Marker in Chroot ModeEPSS 0.4%CVE-2017-7501—It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with abilitEPSS 0.4%CVE-2020-7250HIGHENS symbolic link log file manipulation vulnerabilityEPSS 0.4%CVE-2023-25145HIGHA link following vulnerability in the scanning function of Trend Micro Apex One agent could allow a local attacker to escalate privileges onEPSS 0.4%CVE-2020-7319HIGHImproper Access Control Vulnerability in ENS for WindowsEPSS 0.4%CVE-2021-32557MEDIUMapport process_report() arbitrary file writeEPSS 0.4%CVE-2023-25148HIGHA security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to exploit the vulnerability by changing EPSS 0.4%CVE-2023-25146HIGHA security agent link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to quarantine a file, delete thEPSS 0.4%CVE-2024-6147HIGHPoly Plantronics Hub Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-45491MEDIUM.NET Tampering VulnerabilityEPSS 0.4%CVE-2025-59281HIGHXbox Gaming Services Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-27850HIGHThe locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack. If a malicious graphics package containing symlEPSS 0.4%CVE-2023-42942HIGHThis issue was addressed with improved handling of symlinks. This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, tvOS 17.1, iOS 16.7.2 aEPSS 0.4%