Weaknesses of type CWE-59

823 results

Seguimento inseguro de links simbólicos

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o destino é legítimo, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo com privilégio elevado que acessa `/tmp/arquivo` pode ser redirecionado por um symlink malicioso para ler ou modificar `/etc/passwd`, por exemplo.

Example

Um script root copia logs da aplicação de `/tmp/app.log` para `/var/log/backup.log`. Um atacante cria um symlink `/tmp/app.log` → `/etc/shadow` e aguarda a execução do script; o arquivo sensível é então copiado e exposto.

How to mitigate

Use APIs seguras como `O_NOFOLLOW` (em open/openat) ou `lstat()` para detectar symlinks antes de operar. Valide o proprietário e permissões de arquivos alvo, e armazene arquivos temporários em diretórios privados (não `/tmp`), com umask restritivo.

CVE-2026-32024MEDIUMOpenClaw < 2026.2.22 - Symlink Traversal in Avatar HandlingEPSS 0.3%CVE-2020-7325MEDIUMPrivilege Escalation vulnerability in MVISION EndpointEPSS 0.3%CVE-2026-19820MEDIUMBackblaze Client for Windows Improper Link Resolution VulnerabilityEPSS 0.3%CVE-2026-5161HIGHImproper Authentication in TUBITAK BILGEM's Pardus AboutEPSS 0.3%CVE-2026-17106HIGHTar extraction in moby/go-archive can write outside the destination directory via link followingEPSS 0.3%CVE-2021-35937—A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in EPSS 0.3%CVE-2026-11322HIGHHermes WebUI before 0.51.221 Path Traversal via Symlink Workspace BypassEPSS 0.3%CVE-2022-31250HIGHkeylime %post scriplet allows for privilege escalation from keylime user to rootEPSS 0.3%CVE-2021-32553HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2026-17459MEDIUMperwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlinkEPSS 0.3%CVE-2024-7251HIGHComodo Internet Security Pro cmdagent Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2024-7252HIGHComodo Internet Security Pro cmdagent Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2024-7250HIGHComodo Internet Security Pro cmdagent Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-55074HIGHAnsible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)EPSS 0.3%CVE-2026-71964HIGHCyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP UploadEPSS 0.3%CVE-2020-8013LOWpermissions: chkstat sets unintended setuid/capabilities for mrsh and wodimEPSS 0.3%CVE-2025-5474HIGH2BrightSparks SyncBackFree Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2022-38699MEDIUMASUS Armoury Crate Service - Arbitrary File Creation via Elevation of Privilege FlawEPSS 0.3%CVE-2026-89258CRITICALHugo before v0.165.0 Symlink Confinement Bypass via resources.GetEPSS 0.3%CVE-2022-31217HIGHDrive Composer Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%