Weaknesses of type CWE-61

197 results

Seguimento de link simbólico UNIX não validado

Uma aplicação segue um link simbólico (symlink) sem validar para onde ele aponta, permitindo que um atacante redirecione operações de arquivo para locais arbitrários do sistema. Se o programa tem privilégios elevados, o atacante consegue ler, modificar ou deletar arquivos sensíveis fora do escopo pretendido.

Example

Um script de backup roda como root e processa arquivos em /tmp/dados. Um atacante cria um symlink /tmp/dados → /etc/passwd. Quando o script segue o link, ele acaba manipulando o arquivo de senhas do sistema em vez do arquivo de dados esperado.

How to mitigate

Valide symlinks antes de operar sobre eles: use funções como `realpath()` ou `readlink()` para verificar o caminho real e garantir que ele está dentro do diretório esperado. Alternativamente, configure permissões restritivas em diretórios temporários (use sticky bit em /tmp, ou crie diretórios privados) para impedir que outros usuários injetem symlinks maliciosos.

CVE-2026-7397MEDIUMNousResearch hermes-agent file_tools.py _check_sensitive_path symlinkEPSS 0.1%CVE-2026-35372MEDIUMuutils coreutils ln Security Bypass via Improper Handling of the --no-dereference FlagEPSS 0.1%CVE-2025-36564HIGHDell Encryption Admin Utilities versions prior to 11.10.2 contain an Improper Link Resolution vulnerability. A local malicious user could poEPSS 0.1%CVE-2026-106566MEDIUMImageMagick: Policy Bypass in delegate symlink cleanup due to missing checkEPSS 0.1%CVE-2026-65109MEDIUMNVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of EPSS 0.1%CVE-2025-43991MEDIUMSupportAssist for Home PCs versions 4.8.2 and prior and SupportAssist for Business PCs versions 4.5.3 and prior, contain an UNIX Symbolic LiEPSS 0.1%CVE-2026-7832HIGHIObit Advanced SystemCare Service ASC.exe symlinkEPSS 0.1%CVE-2026-21916HIGHJunos OS: A low privileged user can escalate their privileges so that they can login as rootEPSS 0.1%CVE-2026-105712LOWgpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When extracting an untrusted archive with --directoryEPSS 0.1%CVE-2026-40354LOWFlatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash any file in the host context via a symlinkEPSS 0.1%CVE-2026-91202MEDIUMCockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged pasteEPSS 0.1%CVE-2026-96807MEDIUMIn Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to writEPSS 0.1%CVE-2026-96808HIGHIn Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, validEPSS 0.1%CVE-2026-64846LOWNix: Arbitrary file truncation outside the sandbox with recursive-nix experimental featureEPSS 0.1%CVE-2026-42306HIGHMoby: Race condition in docker cp allows bind mount redirection to host pathEPSS 0.1%CVE-2026-102740MEDIUMAsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlinkEPSS 0.1%CVE-2026-123962HIGHIn FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorized_keys fEPSS —