Weaknesses of type CWE-59

823 results

Seguimento inseguro de links simbólicos

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o destino é legítimo, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo com privilégio elevado que acessa `/tmp/arquivo` pode ser redirecionado por um symlink malicioso para ler ou modificar `/etc/passwd`, por exemplo.

Example

Um script root copia logs da aplicação de `/tmp/app.log` para `/var/log/backup.log`. Um atacante cria um symlink `/tmp/app.log` → `/etc/shadow` e aguarda a execução do script; o arquivo sensível é então copiado e exposto.

How to mitigate

Use APIs seguras como `O_NOFOLLOW` (em open/openat) ou `lstat()` para detectar symlinks antes de operar. Valide o proprietário e permissões de arquivos alvo, e armazene arquivos temporários em diretórios privados (não `/tmp`), com umask restritivo.

CVE-2021-32550HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2025-24242MEDIUMThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4. An app with root privileges may be aEPSS 0.3%CVE-2021-32554HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32551HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32555HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32552HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2023-0652HIGHLocal Privilege Escalation in Cloudflare WARP Installer (Windows)EPSS 0.3%CVE-2026-48921HIGHJenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing aEPSS 0.3%CVE-2026-53476CRITICALAssisted-migration-agent: vddk tarball chained-symlink arbitrary file writeEPSS 0.3%CVE-2026-90807MEDIUMnanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link followingEPSS 0.3%CVE-2019-13689HIGHInappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remote attacker to perform arbitrary read/wrEPSS 0.3%CVE-2024-45770MEDIUMPcp: pmpost symlink attack allows escalating pcp to root userEPSS 0.3%CVE-2022-21944HIGHwatchman: chown in watchman@.socket unit allows symlink attackEPSS 0.3%CVE-2026-53801HIGHrsync < 3.5.0 Symlink Race Condition Directory TraversalEPSS 0.3%CVE-2026-65680MEDIUMMicrosoft OneDrive for MacOS Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-40610MEDIUMBentoML has Information Disclosure in `bentoml build` via symlink traversal in the build contextEPSS 0.3%CVE-2023-24577MEDIUMMcAfee Total Protection prior to 16.0.50 allows attackers to elevate user privileges due to Improper Link Resolution via registry keys. ThisEPSS 0.3%CVE-2024-13043HIGHPanda Security Dome Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2025-24136MEDIUMThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS VenturaEPSS 0.3%CVE-2025-65843HIGHAquarius Desktop 3.0.069 for macOS contains an insecure file handling vulnerability in its support data archive generation feature. The applEPSS 0.3%