Weaknesses of type CWE-59

823 results

Seguimento inseguro de links simbólicos

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o destino é legítimo, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo com privilégio elevado que acessa `/tmp/arquivo` pode ser redirecionado por um symlink malicioso para ler ou modificar `/etc/passwd`, por exemplo.

Example

Um script root copia logs da aplicação de `/tmp/app.log` para `/var/log/backup.log`. Um atacante cria um symlink `/tmp/app.log` → `/etc/shadow` e aguarda a execução do script; o arquivo sensível é então copiado e exposto.

How to mitigate

Use APIs seguras como `O_NOFOLLOW` (em open/openat) ou `lstat()` para detectar symlinks antes de operar. Valide o proprietário e permissões de arquivos alvo, e armazene arquivos temporários em diretórios privados (não `/tmp`), com umask restritivo.

CVE-2025-30457CRITICALThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS VenturaEPSS 1.2%CVE-2024-12754MEDIUMAnyDesk Link Following Information Disclosure VulnerabilityEPSS 1.2%CVE-2024-26199HIGHMicrosoft Office Elevation of Privilege VulnerabilityEPSS 1.2%CVE-2024-30093HIGHWindows Storage Elevation of Privilege VulnerabilityEPSS 1.1%CVE-2016-8641MEDIUMA privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely chEPSS 1.1%CVE-2022-24904MEDIUMSymlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-serverEPSS 1.1%CVE-2026-33001HIGHJenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives,EPSS 1.1%CVE-2023-36047HIGHWindows Authentication Elevation of Privilege VulnerabilityEPSS 1.1%CVE-2025-48799HIGHWindows Update Service Elevation of Privilege VulnerabilityEPSS 1.1%CVE-2024-21329HIGHAzure Connected Machine Agent Elevation of Privilege VulnerabilityEPSS 1.1%CVE-2021-43237HIGHWindows Setup Elevation of Privilege VulnerabilityEPSS 1.0%CVE-2026-57991HIGHMicrosoft Edge (Chromium-based) Information Disclosure VulnerabilityEPSS 1.0%CVE-2024-9341MEDIUMPodman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go libraryEPSS 1.0%CVE-2025-21331HIGHWindows Installer Elevation of Privilege VulnerabilityEPSS 1.0%CVE-2025-55188LOW7-Zip before 25.01 does not always properly handle symbolic links during extraction.EPSS 1.0%CVE-2026-50549CRITICALCursor Desktop sandbox escape via symlink and failed path canonicalizationEPSS 1.0%CVE-2021-30356—A denial of service vulnerability was reported in Check Point Identity Agent before R81.018.0000, which could allow low privileged users to EPSS 1.0%CVE-2025-27727HIGHWindows Installer Elevation of Privilege VulnerabilityEPSS 1.0%CVE-2023-51636HIGHAvira Prime Link Following Local Privilege Escalation VulnerabilityEPSS 1.0%CVE-2023-25168CRITICALSymbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wingsEPSS 1.0%