Weaknesses of type CWE-59

823 results

Seguimento inseguro de links simbólicos

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o destino é legítimo, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo com privilégio elevado que acessa `/tmp/arquivo` pode ser redirecionado por um symlink malicioso para ler ou modificar `/etc/passwd`, por exemplo.

Example

Um script root copia logs da aplicação de `/tmp/app.log` para `/var/log/backup.log`. Um atacante cria um symlink `/tmp/app.log` → `/etc/shadow` e aguarda a execução do script; o arquivo sensível é então copiado e exposto.

How to mitigate

Use APIs seguras como `O_NOFOLLOW` (em open/openat) ou `lstat()` para detectar symlinks antes de operar. Valide o proprietário e permissões de arquivos alvo, e armazene arquivos temporários em diretórios privados (não `/tmp`), com umask restritivo.

CVE-2025-11578HIGHPre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege EscalationEPSS 0.7%CVE-2023-36711HIGHWindows Runtime C++ Template Library Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2024-44131MEDIUMThis issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be EPSS 0.7%CVE-2026-39246HIGHdecompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries (type === 'symlink'), tEPSS 0.7%CVE-2024-38084HIGHMicrosoft OfficePlus Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2025-66277CRITICALQTS, QuTS heroEPSS 0.7%CVE-2025-29837MEDIUMWindows Installer Information Disclosure VulnerabilityEPSS 0.7%CVE-2024-43501HIGHWindows Common Log File System Driver Elevation of Privilege VulnerabilityEPSS 0.7%CVE-2021-23873HIGHMcAfee Total Protection (MTP) privilege escalation vulnerabilityEPSS 0.7%CVE-2026-45539HIGHMicrosoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project treeEPSS 0.7%CVE-2024-38097HIGHAzure Monitor Agent Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2025-24103CRITICALThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS VenturaEPSS 0.6%CVE-2024-28916HIGHXbox Gaming Services Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2023-34283MEDIUMNETGEAR RAX30 USB Share Link Following Information Disclosure VulnerabilityEPSS 0.6%CVE-2025-32721HIGHWindows Recovery Driver Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2026-32013HIGHOpenClaw < 2026.2.25 - Symlink Traversal in agents.files MethodsEPSS 0.6%CVE-2024-38098HIGHAzure Connected Machine Agent Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2024-43551HIGHWindows Storage Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2024-49051HIGHMicrosoft PC Manager Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2024-38013MEDIUMMicrosoft Windows Server Backup Elevation of Privilege VulnerabilityEPSS 0.6%