Weaknesses of type CWE-59

823 results

Seguimento inseguro de links simbólicos

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o destino é legítimo, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo com privilégio elevado que acessa `/tmp/arquivo` pode ser redirecionado por um symlink malicioso para ler ou modificar `/etc/passwd`, por exemplo.

Example

Um script root copia logs da aplicação de `/tmp/app.log` para `/var/log/backup.log`. Um atacante cria um symlink `/tmp/app.log` → `/etc/shadow` e aguarda a execução do script; o arquivo sensível é então copiado e exposto.

How to mitigate

Use APIs seguras como `O_NOFOLLOW` (em open/openat) ou `lstat()` para detectar symlinks antes de operar. Valide o proprietário e permissões de arquivos alvo, e armazene arquivos temporários em diretórios privados (não `/tmp`), com umask restritivo.

CVE-2026-55443MEDIUMLangChain: Path traversal and sandbox escape in LangChain file-search middleware and loadersEPSS 0.2%CVE-2024-27458HIGHHP Hotkey Support – Escalation of PrivilegeEPSS 0.2%CVE-2025-3908MEDIUMThe configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbEPSS 0.2%CVE-2025-1697MEDIUMHP Touchpoint Analytics Service – Potential Escalation of PrivilegeEPSS 0.2%CVE-2026-76037HIGHLink following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to potentially execute EPSS 0.2%CVE-2023-25940MEDIUM Dell PowerScale OneFS version 9.5.0.0 contains improper link resolution before file access vulnerability in isi_gather_info. A high privileEPSS 0.2%CVE-2026-12391MEDIUMubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitrary File Read in collect-logsEPSS 0.2%CVE-2026-70626HIGHNLTK before 3.9.4 Symlink Escape via CorpusReaderEPSS 0.2%CVE-2026-20610HIGHThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26.3. An app may be able to gain root privilEPSS 0.2%CVE-2025-43395LOWThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 2EPSS 0.2%CVE-2025-66680HIGHAn issue in the WiseDelfile64.sys component of WiseCleaner Wise Force Deleter 7.3.2 and earlier allows attackers to delete arbitrary files vEPSS 0.2%CVE-2026-43765MEDIUMThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 2EPSS 0.2%CVE-2024-0068MEDIUMImproper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Workforce Access on MacOS allows File Manipulation.ThisEPSS 0.2%CVE-2026-23563MEDIUMPrivilege escalation in TeamViewer DEX via DeleteFileByPath instructionEPSS 0.2%CVE-2026-58414MEDIUMNetwork-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backupsEPSS 0.2%CVE-2025-4211HIGHImproper Link Resolution Before File Access in QFileSystemEngine on WindowsEPSS 0.2%CVE-2026-35400LOWLORIS incorrectly trusts user input in publication moduleEPSS 0.2%CVE-2025-43379MEDIUMThis issue was addressed with improved validation of symlinks. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS EPSS 0.2%CVE-2026-42795MEDIUMSymlink Following in Hex Package Export Allows Embedding Files Outside Project RootEPSS 0.2%CVE-2025-8612HIGHAOMEI Backupper Workstation Link Following Local Privilege Escalation VulnerabilityEPSS 0.2%