Weaknesses of type CWE-61

173 results

Seguimento de link simbólico UNIX não validado

Uma aplicação segue um link simbólico (symlink) sem validar para onde ele aponta, permitindo que um atacante redirecione operações de arquivo para locais arbitrários do sistema. Se o programa tem privilégios elevados, o atacante consegue ler, modificar ou deletar arquivos sensíveis fora do escopo pretendido.

Example

Um script de backup roda como root e processa arquivos em /tmp/dados. Um atacante cria um symlink /tmp/dados → /etc/passwd. Quando o script segue o link, ele acaba manipulando o arquivo de senhas do sistema em vez do arquivo de dados esperado.

How to mitigate

Valide symlinks antes de operar sobre eles: use funções como `realpath()` ou `readlink()` para verificar o caminho real e garantir que ele está dentro do diretório esperado. Alternativamente, configure permissões restritivas em diretórios temporários (use sticky bit em /tmp, ou crie diretórios privados) para impedir que outros usuários injetem symlinks maliciosos.

CVE-2024-45310LOWrunc can be confused to create empty files/directories on the hostEPSS 0.3%CVE-2026-57825MEDIUMIn the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .EPSS 0.3%CVE-2023-41969HIGHZSATrayManager Arbitrary File DeletionEPSS 0.3%CVE-2025-33225HIGHNVIDIA Resiliency Extension for Linux contains a vulnerability in log aggregation, where an attacker could cause predictable log-file names.EPSS 0.3%CVE-2021-32547HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2026-5223MEDIUMCrates in third party registries can override the cached source of other cratesEPSS 0.3%CVE-2021-32548HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32549HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32552HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32554HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32555HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2020-15075—OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access via symlinks in /tmpEPSS 0.3%CVE-2021-32550HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32551HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2025-43853HIGHiwasm vulnerable to filesystem sandbox escape with symlink when using uvwasi featureEPSS 0.3%CVE-2026-23986MEDIUMCopier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: trueEPSS 0.3%CVE-2026-28684MEDIUMpython-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallbackEPSS 0.3%CVE-2025-66431HIGHWebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root viaEPSS 0.3%CVE-2024-27872MEDIUMThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sonoma 14.6. An app may be able to access protecEPSS 0.3%CVE-2021-1612MEDIUMCisco IOS XE SD-WAN Software Arbitrary File Overwrite VulnerabilityEPSS 0.3%