Weaknesses of type CWE-59

823 results

Seguimento inseguro de links simbólicos

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o destino é legítimo, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo com privilégio elevado que acessa `/tmp/arquivo` pode ser redirecionado por um symlink malicioso para ler ou modificar `/etc/passwd`, por exemplo.

Example

Um script root copia logs da aplicação de `/tmp/app.log` para `/var/log/backup.log`. Um atacante cria um symlink `/tmp/app.log` → `/etc/shadow` e aguarda a execução do script; o arquivo sensível é então copiado e exposto.

How to mitigate

Use APIs seguras como `O_NOFOLLOW` (em open/openat) ou `lstat()` para detectar symlinks antes de operar. Valide o proprietário e permissões de arquivos alvo, e armazene arquivos temporários em diretórios privados (não `/tmp`), com umask restritivo.

CVE-2019-1129HIGHAn elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows ElEPSS 1.8%KEVCVE-2023-29343HIGHSysInternals Sysmon for Windows Elevation of Privilege VulnerabilityEPSS 1.7%CVE-2024-30076MEDIUMWindows Container Manager Service Elevation of Privilege VulnerabilityEPSS 1.7%CVE-2017-12258—A vulnerability in the web-based UI of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to execute a croEPSS 1.7%CVE-2026-34078CRITICALFlatpak has a complete sandbox escape leading to host file access and code execution in the host contextEPSS 1.7%CVE-2024-12390HIGHRemote Code Execution in binary-husky/gpt_academicEPSS 1.7%CVE-2023-36903HIGHWindows System Assessment Tool Elevation of Privilege VulnerabilityEPSS 1.6%CVE-2021-44052MEDIUMArbitrary file readEPSS 1.6%CVE-2024-6868HIGHArbitrary File Write in mudler/LocalAIEPSS 1.5%CVE-2024-30104HIGHMicrosoft Office Remote Code Execution VulnerabilityEPSS 1.5%CVE-2025-24104MEDIUMThis issue was addressed with improved handling of symlinks. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4. Restoring a malEPSS 1.5%CVE-2024-50404MEDIUMQsync CentralEPSS 1.4%CVE-2024-21447HIGHWindows Authentication Elevation of Privilege VulnerabilityEPSS 1.4%CVE-2021-1491MEDIUMCisco SD-WAN vManage Software Information Disclosure VulnerabilityEPSS 1.3%CVE-2023-36758HIGHVisual Studio Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2024-38081HIGH.NET, .NET Framework, and Visual Studio Elevation of Privilege VulnerabilityEPSS 1.3%CVE-2023-32056HIGHWindows Server Update Service (WSUS) Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2026-63294CRITICALRoot RCE via image backup.yaml symlinkEPSS 1.2%CVE-2019-8463—A denial of service vulnerability was reported in Check Point Endpoint Security Client for Windows before E82.10, that could allow service lEPSS 1.2%CVE-2020-26277MEDIUMArbitrary read/write in DBdeployerEPSS 1.2%