Weaknesses of type CWE-59

823 results

Seguimento inseguro de links simbólicos

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o destino é legítimo, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo com privilégio elevado que acessa `/tmp/arquivo` pode ser redirecionado por um symlink malicioso para ler ou modificar `/etc/passwd`, por exemplo.

Example

Um script root copia logs da aplicação de `/tmp/app.log` para `/var/log/backup.log`. Um atacante cria um symlink `/tmp/app.log` → `/etc/shadow` e aguarda a execução do script; o arquivo sensível é então copiado e exposto.

How to mitigate

Use APIs seguras como `O_NOFOLLOW` (em open/openat) ou `lstat()` para detectar symlinks antes de operar. Valide o proprietário e permissões de arquivos alvo, e armazene arquivos temporários em diretórios privados (não `/tmp`), com umask restritivo.

CVE-2024-30033HIGHWindows Search Service Elevation of Privilege VulnerabilityEPSS 1.0%CVE-2024-48862HIGHQuLog CenterEPSS 0.9%CVE-2023-21722MEDIUM.NET Framework Denial of Service VulnerabilityEPSS 0.9%CVE-2024-3829CRITICALArbitrary File Read and Write during Snapshot Recovery in qdrant/qdrantEPSS 0.9%CVE-2023-7216MEDIUMCpio: extraction allows symlinks which enables remote command executionEPSS 0.9%CVE-2023-33865HIGHRenderDoc before 1.27 allows local privilege escalation via a symlink attack. It relies on the /tmp/RenderDoc directory regardless of ownersEPSS 0.9%CVE-2024-36305HIGHA security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instalEPSS 0.9%CVE-2024-30018HIGHWindows Kernel Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2023-35624HIGHAzure Connected Machine Agent Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2023-33245HIGHMinecraft through 1.19 and 1.20 pre-releases before 7 (Java) allow arbitrary file overwrite, and possibly code execution, via crafted world EPSS 0.9%CVE-2024-26216HIGHWindows File Server Resource Management Service Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2026-15815HIGHCVE-2026-15815 CVE RecordEPSS 0.9%CVE-2025-43220CRITICALThis issue was addressed with improved validation of symlinks. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7EPSS 0.9%CVE-2024-43470HIGHAzure Network Watcher VM Agent Elevation of Privilege VulnerabilityEPSS 0.9%CVE-2026-70563HIGHWindows Shell Spoofing VulnerabilityEPSS 0.8%CVE-2024-10007HIGHPre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege EscalationEPSS 0.8%CVE-2026-53535MEDIUMActivepieces: Arbitrary file write in git-sync via path traversal and symlinksEPSS 0.8%CVE-2024-30065MEDIUMWindows Themes Denial of Service VulnerabilityEPSS 0.8%CVE-2025-23267HIGHNVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook, where an attacker could cause a link followiEPSS 0.8%CVE-2022-4122MEDIUMA vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in informatioEPSS 0.8%