Weaknesses of type CWE-59

823 results

Seguimento inseguro de links simbólicos

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o destino é legítimo, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo com privilégio elevado que acessa `/tmp/arquivo` pode ser redirecionado por um symlink malicioso para ler ou modificar `/etc/passwd`, por exemplo.

Example

Um script root copia logs da aplicação de `/tmp/app.log` para `/var/log/backup.log`. Um atacante cria um symlink `/tmp/app.log` → `/etc/shadow` e aguarda a execução do script; o arquivo sensível é então copiado e exposto.

How to mitigate

Use APIs seguras como `O_NOFOLLOW` (em open/openat) ou `lstat()` para detectar symlinks antes de operar. Valide o proprietário e permissões de arquivos alvo, e armazene arquivos temporários em diretórios privados (não `/tmp`), com umask restritivo.

CVE-2026-11837HIGHAnsible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation via symlink-following chownEPSS 0.2%CVE-2024-13944HIGHLink Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate (Also affects Avast CleanUp and AVG TuneUp)EPSS 0.2%CVE-2026-35365MEDIUMuutils coreutils mv Denial of Service and Data Duplication via Improper Symlink ExpansionEPSS 0.2%CVE-2026-77179CRITICALDocker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallbackEPSS 0.2%CVE-2025-15324MEDIUMTanium addressed a local privilege escalation vulnerability in Engage.EPSS 0.2%CVE-2026-49114MEDIUMONNX symlink-following and path-traversal arbitrary file writeEPSS 0.2%CVE-2026-44220LOWciguard: discover_pipeline_files follows symlinks out of scan rootEPSS 0.2%CVE-2026-8784MEDIUMnpitre cramfs-tools cramfsck.c change_file_status symlinkEPSS 0.2%CVE-2026-44470HIGHClaude Desktop: Local Privilege Escalation via Directory Junction in CoworkVMServiceEPSS 0.2%CVE-2026-21419MEDIUMDell Display and Peripheral Manager (Windows) versions prior to 2.2 contain an Improper Link Resolution Before File Access ('Link Following'EPSS 0.2%CVE-2026-46406MEDIUMClaude Code: Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File WriteEPSS 0.2%CVE-2026-54369HIGHacl < 2.4.0 Symlink Traversal Privilege Escalation via libacl FunctionsEPSS 0.2%CVE-2026-33694HIGHJunction File ManipulationEPSS 0.2%CVE-2025-12418MEDIUMPotential Denial of Service in Supported Versions of Revenera InstallShieldEPSS 0.2%CVE-2026-56651LOWArbitrary File Overwrite via Symlink Following in dool projectEPSS 0.2%CVE-2026-85092MEDIUMLiME through 1.12.0 Arbitrary File Overwrite via Symlink FollowingEPSS 0.2%CVE-2026-5061MEDIUMConsul-template vulnerable to sandbox path bypass in file helper via a symlink attackEPSS 0.2%CVE-2025-3771HIGHA path or symbolic link manipulation vulnerability in SIR 1.0.3 and prior versions allows an authenticated non-admin local user to overwriteEPSS 0.2%CVE-2026-13268HIGHG DATA Total Security Backup Service Link Following Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-7012HIGHCato Networks Linux Client Local Privilege Escalation via SymlinkEPSS 0.1%