Weaknesses of type CWE-59

823 results

Seguimento inseguro de links simbólicos

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o destino é legítimo, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo com privilégio elevado que acessa `/tmp/arquivo` pode ser redirecionado por um symlink malicioso para ler ou modificar `/etc/passwd`, por exemplo.

Example

Um script root copia logs da aplicação de `/tmp/app.log` para `/var/log/backup.log`. Um atacante cria um symlink `/tmp/app.log` → `/etc/shadow` e aguarda a execução do script; o arquivo sensível é então copiado e exposto.

How to mitigate

Use APIs seguras como `O_NOFOLLOW` (em open/openat) ou `lstat()` para detectar symlinks antes de operar. Valide o proprietário e permissões de arquivos alvo, e armazene arquivos temporários em diretórios privados (não `/tmp`), com umask restritivo.

CVE-2026-25187HIGHWinlogon Elevation of Privilege VulnerabilityEPSS 3.2%CVE-2020-0638HIGHAn elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an atEPSS 3.0%KEVCVE-2022-21919HIGHWindows User Profile Service Elevation of Privilege VulnerabilityEPSS 3.0%KEVCVE-2010-4226HIGHcpio, as used in build 2007.05.10, 2010.07.28, and possibly other versions, allows remote attackers to overwrite arbitrary files via a symliEPSS 2.9%CVE-2020-3437MEDIUMCisco SD-WAN vManage Software Information Disclosure VulnerabilityEPSS 2.9%CVE-2022-22995CRITICALWestern Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in NetatalkEPSS 2.8%CVE-2018-10928HIGHA flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside EPSS 2.7%CVE-2024-35235MEDIUMCupsd Listen arbitrary chmod 0140777EPSS 2.4%CVE-2025-21391HIGHWindows Storage Elevation of Privilege VulnerabilityEPSS 2.3%KEVCVE-2019-1130HIGHAn elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows ElEPSS 2.3%KEVCVE-2026-42989HIGHWinlogon Elevation of Privilege VulnerabilityEPSS 2.3%CVE-2024-12905HIGHAn Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path TraEPSS 2.2%CVE-2023-4759HIGHImproper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file writeEPSS 2.2%CVE-2023-36723HIGHWindows Container Manager Service Elevation of Privilege VulnerabilityEPSS 2.2%CVE-2023-33148HIGHMicrosoft Office Elevation of Privilege VulnerabilityEPSS 2.1%CVE-2024-49107HIGHWmsRepair Service Elevation of Privilege VulnerabilityEPSS 1.9%CVE-2020-3223MEDIUMCisco IOS XE Software Web UI Arbitrary File Read VulnerabilityEPSS 1.9%CVE-2020-13095—Little Snitch version 4.5.1 and older changed ownership of a directory path controlled by the user. This allowed the user to escalate to rooEPSS 1.9%CVE-2021-37712HIGHArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic linksEPSS 1.8%CVE-2023-29351HIGHWindows Group Policy Elevation of Privilege VulnerabilityEPSS 1.8%