Weaknesses of type CWE-59

823 results

Seguimento inseguro de links simbólicos

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o destino é legítimo, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo com privilégio elevado que acessa `/tmp/arquivo` pode ser redirecionado por um symlink malicioso para ler ou modificar `/etc/passwd`, por exemplo.

Example

Um script root copia logs da aplicação de `/tmp/app.log` para `/var/log/backup.log`. Um atacante cria um symlink `/tmp/app.log` → `/etc/shadow` e aguarda a execução do script; o arquivo sensível é então copiado e exposto.

How to mitigate

Use APIs seguras como `O_NOFOLLOW` (em open/openat) ou `lstat()` para detectar symlinks antes de operar. Valide o proprietário e permissões de arquivos alvo, e armazene arquivos temporários em diretórios privados (não `/tmp`), com umask restritivo.

CVE-2026-70622HIGHtar-rs 0.4.11 - 0.4.46 Symlink Escape via append_dir_all()EPSS 0.3%CVE-2026-19008MEDIUMmf-yang openclaw-cn apply_patch Tool sandbox-paths.ts assertNoSymlinkEscape link followingEPSS 0.3%CVE-2025-54798LOWtmp does not restrict arbitrary temporary file / directory write via symbolic link `dir` parameterEPSS 0.3%CVE-2023-27850—NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a file sharing mechanism that allows users with access to this feature to accessEPSS 0.3%CVE-2024-7243HIGHPanda Security Dome Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2021-31997MEDIUMpython-postorius: postorius-permissions.sh used during %post allows local privilege escalation from postorius user to rootEPSS 0.3%CVE-2026-47121MEDIUMSparkle: Binary delta apply intermediate-symlink traversal in malicious .deltaEPSS 0.3%CVE-2024-7241HIGHPanda Security Dome Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2024-7242HIGHPanda Security Dome Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2022-34292HIGHDocker Desktop for Windows before 4.6.0 allows attackers to overwrite any file through a symlink attack on the hyperv/create dockerBackendV2EPSS 0.3%CVE-2026-19909HIGHPAX Technology Q80 AIP File Parsing Link Following Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-21195MEDIUMAzure Service Fabric Runtime Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2022-31647HIGHDocker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 API via a symlink in tEPSS 0.3%CVE-2025-49738HIGHMicrosoft PC Manager Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-2490MEDIUMRustDesk Client for Windows Transfer File Link Following Information Disclosure VulnerabilityEPSS 0.3%CVE-2025-67124MEDIUMA TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arEPSS 0.3%CVE-2026-50511HIGHMicrosoft PC Manager Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2023-42099HIGHIntel Driver & Support Assistant Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-70427MEDIUMJenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction EPSS 0.3%CVE-2026-32024MEDIUMOpenClaw < 2026.2.22 - Symlink Traversal in Avatar HandlingEPSS 0.3%