Weaknesses of type CWE-61

173 results

Seguimento de link simbólico UNIX não validado

Uma aplicação segue um link simbólico (symlink) sem validar para onde ele aponta, permitindo que um atacante redirecione operações de arquivo para locais arbitrários do sistema. Se o programa tem privilégios elevados, o atacante consegue ler, modificar ou deletar arquivos sensíveis fora do escopo pretendido.

Example

Um script de backup roda como root e processa arquivos em /tmp/dados. Um atacante cria um symlink /tmp/dados → /etc/passwd. Quando o script segue o link, ele acaba manipulando o arquivo de senhas do sistema em vez do arquivo de dados esperado.

How to mitigate

Valide symlinks antes de operar sobre eles: use funções como `realpath()` ou `readlink()` para verificar o caminho real e garantir que ele está dentro do diretório esperado. Alternativamente, configure permissões restritivas em diretórios temporários (use sticky bit em /tmp, ou crie diretórios privados) para impedir que outros usuários injetem symlinks maliciosos.

CVE-2024-52535HIGHDell SupportAssist for Home PCs versions 4.6.1 and prior and Dell SupportAssist for Business PCs versions 4.5.0 and prior, contain a symboliEPSS 0.5%CVE-2024-47877MEDIUMExtract has insufficient checks allowing attacker to create symlinks outside the extraction directory.EPSS 0.5%CVE-2026-24047MEDIUM@backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain BypassEPSS 0.5%CVE-2026-55168MEDIUMRuntipi: Authenticated arbitrary file write via backup restore symlink plantingEPSS 0.5%CVE-2020-8019HIGHsyslog-ng: Local privilege escalation from new to root in %postEPSS 0.5%CVE-2026-63125CRITICALIncus vulnerable to root RCE via image backup.yaml symlinkEPSS 0.5%CVE-2025-68937CRITICALForgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-EPSS 0.5%CVE-2020-8014HIGHkopano-python-services: Local privilege escalation from kopano to root in kopano-spamd subpackageEPSS 0.5%CVE-2026-29203MEDIUMA chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system filEPSS 0.5%CVE-2026-27976HIGHZed Extension Sandbox Escape via Tar Symlink FollowingEPSS 0.5%CVE-2024-45418MEDIUMZoom Apps for macOS - Symbolic Link FollowingEPSS 0.5%CVE-2026-52811CRITICALGogs: UploadRepoFiles writes outside repo working tree via committed parent symEPSS 0.5%CVE-2025-24886HIGHpwn.college has Symlink LFI in Dojo reposEPSS 0.5%CVE-2025-10854HIGHSymlink Following in txtai leads to arbitrary file write when loading untrusted embedding indicesEPSS 0.5%CVE-2025-59829LOWClaude Code: Permission deny bypass is possible through symlinkEPSS 0.4%CVE-2021-25321HIGHarpwatch: Local privilege escalation from runtime user to rootEPSS 0.4%CVE-2021-25322MEDIUMpython-HyperKitty: hyperkitty-permissions.sh used during %post allows local privilege escalation from hyperkitty user to rootEPSS 0.4%CVE-2025-67487MEDIUMStatic Web Server is vulnerable to symbolic link Path TraversalEPSS 0.4%CVE-2026-25724LOWClaude Code Has Permission Deny Bypass Through Symbolic LinksEPSS 0.4%CVE-2026-41937HIGHVvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin UploadEPSS 0.4%