Weaknesses of type CWE-59

823 results

Seguimento inseguro de links simbólicos

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o destino é legítimo, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo com privilégio elevado que acessa `/tmp/arquivo` pode ser redirecionado por um symlink malicioso para ler ou modificar `/etc/passwd`, por exemplo.

Example

Um script root copia logs da aplicação de `/tmp/app.log` para `/var/log/backup.log`. Um atacante cria um symlink `/tmp/app.log` → `/etc/shadow` e aguarda a execução do script; o arquivo sensível é então copiado e exposto.

How to mitigate

Use APIs seguras como `O_NOFOLLOW` (em open/openat) ou `lstat()` para detectar symlinks antes de operar. Valide o proprietário e permissões de arquivos alvo, e armazene arquivos temporários em diretórios privados (não `/tmp`), com umask restritivo.

CVE-2026-62807HIGHWindows DHCP Server Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-50469HIGHWindows Projected File System Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-50438HIGHMicrosoft PC Manager Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-58636HIGHMicrosoft PC Manager Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-55828MEDIUMqbee transport: Symlink-chain path traversal in tar extraction (one level outside destination)EPSS 0.4%CVE-2026-21517MEDIUMWindows App for Mac Installer Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2024-56074MEDIUMgitingest before 9996a06 mishandles symbolic links that point outside of the base directory.EPSS 0.4%CVE-2023-28972MEDIUMJunos OS: NFX Series: 'set system ports console insecure' allows root password recoveryEPSS 0.4%CVE-2020-2024MEDIUMKata Containers - Guests can trick the kata-runtime into unmounting any mount point on the hostEPSS 0.4%CVE-2004-1901MEDIUMPortage before 2.0.50-r3 allows local users to overwrite arbitrary files via a hard link attack on the lockfiles.EPSS 0.4%CVE-2026-41236HIGHFroxlor has privilege escalation in SSH key synchronization via symlinked `authorized_keys` pathEPSS 0.4%CVE-2026-54572HIGHrclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remoteEPSS 0.4%CVE-2019-3693HIGHLocal privilege escalation from user wwwrun to root in the packaging of mailmanEPSS 0.4%CVE-2026-73613HIGHfilebrowser before 2.63.19 Out-of-Scope File Deletion via SymlinkEPSS 0.4%CVE-2023-32163HIGHWacom Drivers for Windows Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-71556HIGHgo-git: Worktree operations may follow symlinksEPSS 0.4%CVE-2025-5718MEDIUMThe ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the AxEPSS 0.4%CVE-2026-62761HIGHWindows DHCP Server Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2020-7346HIGHPrivilege escalation in McAfee DLP Endpoint for WindowsEPSS 0.4%CVE-2026-69289HIGHWindows Setup Files Cleanup Elevation of Privilege VulnerabilityEPSS 0.4%