Weaknesses of type CWE-61

173 results

Seguimento de link simbólico UNIX não validado

Uma aplicação segue um link simbólico (symlink) sem validar para onde ele aponta, permitindo que um atacante redirecione operações de arquivo para locais arbitrários do sistema. Se o programa tem privilégios elevados, o atacante consegue ler, modificar ou deletar arquivos sensíveis fora do escopo pretendido.

Example

Um script de backup roda como root e processa arquivos em /tmp/dados. Um atacante cria um symlink /tmp/dados → /etc/passwd. Quando o script segue o link, ele acaba manipulando o arquivo de senhas do sistema em vez do arquivo de dados esperado.

How to mitigate

Valide symlinks antes de operar sobre eles: use funções como `realpath()` ou `readlink()` para verificar o caminho real e garantir que ele está dentro do diretório esperado. Alternativamente, configure permissões restritivas em diretórios temporários (use sticky bit em /tmp, ou crie diretórios privados) para impedir que outros usuários injetem symlinks maliciosos.

CVE-2026-35525HIGHLiquidJS has a root restriction bypass for partial and layout loading through symlinked templatesEPSS 0.4%CVE-2025-57802HIGHAirlink's Daemon Symlink VulnerabilityEPSS 0.4%CVE-2026-56876HIGHextract-zip unvalidated symlink path traversalEPSS 0.4%CVE-2021-32557MEDIUMapport process_report() arbitrary file writeEPSS 0.4%CVE-2026-33056MEDIUMtar-rs: unpack_in can chmod arbitrary directories by following symlinksEPSS 0.4%CVE-2026-55686MEDIUMPodman: WORKDIR symlink traversal vulnerabilityEPSS 0.4%CVE-2024-0134MEDIUMNVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead tEPSS 0.4%CVE-2026-62992MEDIUMSmarty: Symlink path traversal out of trusted directoriesEPSS 0.4%CVE-2025-5468MEDIUMImproper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, IvantiEPSS 0.4%CVE-2026-7819HIGHpgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file writeEPSS 0.4%CVE-2020-15076—Private Tunnel installer for macOS version 3.0.1 and older versions may corrupt system critical files it should not have access via symlinksEPSS 0.4%CVE-2026-33711MEDIUMIncus vulnerable to local privilege escalation through VM screenshot pathEPSS 0.4%CVE-2026-41326HIGHKata Containers: CopyFile Policy Subversion via SymlinksEPSS 0.3%CVE-2026-42275HIGHzrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/writeEPSS 0.3%CVE-2026-35632MEDIUMOpenClaw <= 2026.2.22 - Symlink Traversal via IDENTITY.md appendFile in agents.create/updateEPSS 0.3%CVE-2026-6475HIGHPostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choiceEPSS 0.3%CVE-2026-43570MEDIUMOpenClaw 2026.3.22 < 2026.4.5 - Symlink Traversal in Remote Marketplace Repository Path HandlingEPSS 0.3%CVE-2021-32553HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2026-17459MEDIUMperwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlinkEPSS 0.3%CVE-2025-30485MEDIUMUNIX symbolic link (Symlink) following issue exists in FutureNet NXR series, VXR series and WXR series routers. Attaching to the affected prEPSS 0.3%