Weaknesses of type CWE-59

823 results

Seguimento inseguro de links simbólicos

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o destino é legítimo, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo com privilégio elevado que acessa `/tmp/arquivo` pode ser redirecionado por um symlink malicioso para ler ou modificar `/etc/passwd`, por exemplo.

Example

Um script root copia logs da aplicação de `/tmp/app.log` para `/var/log/backup.log`. Um atacante cria um symlink `/tmp/app.log` → `/etc/shadow` e aguarda a execução do script; o arquivo sensível é então copiado e exposto.

How to mitigate

Use APIs seguras como `O_NOFOLLOW` (em open/openat) ou `lstat()` para detectar symlinks antes de operar. Valide o proprietário e permissões de arquivos alvo, e armazene arquivos temporários em diretórios privados (não `/tmp`), com umask restritivo.

CVE-2018-1063—Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinEPSS 0.4%CVE-2023-42942HIGHThis issue was addressed with improved handling of symlinks. This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, tvOS 17.1, iOS 16.7.2 aEPSS 0.4%CVE-2026-82252HIGHgitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodulesEPSS 0.4%CVE-2021-31566—An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of EPSS 0.4%CVE-2019-18897HIGHLocal privilege escalation from user salt to rootEPSS 0.4%CVE-2024-7239HIGHVIPRE Advanced Security Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2024-7233HIGHAvast Free Antivirus AvastSvc Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2024-8404HIGHArbitrary File Deletion in PaperCut NG/MF Web Print Hot folderEPSS 0.4%CVE-2024-7232HIGHAvast Free Antivirus AvastSvc Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-14966LOWSymlink guard bypass in unarchive module allows planting symlinks during extractionEPSS 0.4%CVE-2024-7240HIGHF-Secure Total Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-49791HIGHWindows Routing and Remote Access Service (RRAS) Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2019-18901MEDIUMmysql-systemd-helper allows setting 640 permissions of arbitrary filesEPSS 0.4%CVE-2024-5928HIGHVIPRE Advanced Security PMAgent Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-55668MEDIUMFile Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scopeEPSS 0.4%CVE-2023-21725MEDIUMWindows Malicious Software Removal Tool Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-62189HIGHOpenClaw < 2026.6.9 Symlink Following via Mirror SyncEPSS 0.4%CVE-2026-53783HIGHrsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsyncEPSS 0.4%CVE-2026-34604HIGH@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or JunctionsEPSS 0.4%CVE-2026-62803HIGHWindows DHCP Server Elevation of Privilege VulnerabilityEPSS 0.4%