Weaknesses of type CWE-59

823 results

Seguimento inseguro de links simbólicos

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o destino é legítimo, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo com privilégio elevado que acessa `/tmp/arquivo` pode ser redirecionado por um symlink malicioso para ler ou modificar `/etc/passwd`, por exemplo.

Example

Um script root copia logs da aplicação de `/tmp/app.log` para `/var/log/backup.log`. Um atacante cria um symlink `/tmp/app.log` → `/etc/shadow` e aguarda a execução do script; o arquivo sensível é então copiado e exposto.

How to mitigate

Use APIs seguras como `O_NOFOLLOW` (em open/openat) ou `lstat()` para detectar symlinks antes de operar. Valide o proprietário e permissões de arquivos alvo, e armazene arquivos temporários em diretórios privados (não `/tmp`), com umask restritivo.

CVE-2026-14361MEDIUMConsul-template is vulnerable to path redirection in writeToFile through symlink attackEPSS 0.1%CVE-2026-53796MEDIUMrsync < 3.5.0 TOCTOU Race Condition via Destination Directory HandlingEPSS 0.1%CVE-2026-92253MEDIUMArbitrary File Write via Directory Junction in WatchDog Anti-Virus Quarantine RestorationEPSS 0.1%CVE-2026-7832HIGHIObit Advanced SystemCare Service ASC.exe symlinkEPSS 0.1%CVE-2026-76845MEDIUMadm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on ExtractionEPSS 0.1%CVE-2026-32020MEDIUMOpenClaw < 2026.2.22 - Arbitrary File Read via Symlink Following in Static File HandlerEPSS 0.1%CVE-2026-22180MEDIUMOpenClaw < 2026.3.2 - Path Confinement Bypass in Browser Output and File Write OperationsEPSS 0.1%CVE-2026-79699MEDIUMPodman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directoryEPSS 0.1%CVE-2026-16989HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2026-49135HIGHCodexBar < 0.32.0 Insecure Temporary File Handling in Notarization WorkflowEPSS 0.1%CVE-2026-20161MEDIUMCisco ThousandEyes Enterprise Agent Arbitrary File Overwrite VulnerabilityEPSS 0.1%CVE-2026-63426MEDIUMDuring an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated loEPSS 0.1%CVE-2026-17171HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2026-8052MEDIUMNomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attackEPSS 0.1%CVE-2026-72694HIGHMrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulationEPSS 0.1%CVE-2026-22701MEDIUMfilelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLockEPSS 0.1%CVE-2025-24918MEDIUMImproper link resolution before file access ('link following') for some Intel(R) Server Configuration Utility software and Intel(R) Server FEPSS 0.1%CVE-2026-48693MEDIUMFastNetMon Community Edition through 1.2.9 is vulnerable to a local symlink attack via predictable file paths in /tmp. The statistics file pEPSS 0.1%CVE-2026-32054MEDIUMOpenClaw < 2026.2.25 - Symlink Traversal in Browser Trace/Download Path HandlingEPSS 0.1%CVE-2026-45384MEDIUMbit7z: Arbitrary File Overwrite via Symlink Attack on Predictable Temp File During Archive UpdateEPSS 0.1%