Weaknesses of type CWE-61

173 results

Seguimento de link simbólico UNIX não validado

Uma aplicação segue um link simbólico (symlink) sem validar para onde ele aponta, permitindo que um atacante redirecione operações de arquivo para locais arbitrários do sistema. Se o programa tem privilégios elevados, o atacante consegue ler, modificar ou deletar arquivos sensíveis fora do escopo pretendido.

Example

Um script de backup roda como root e processa arquivos em /tmp/dados. Um atacante cria um symlink /tmp/dados → /etc/passwd. Quando o script segue o link, ele acaba manipulando o arquivo de senhas do sistema em vez do arquivo de dados esperado.

How to mitigate

Valide symlinks antes de operar sobre eles: use funções como `realpath()` ou `readlink()` para verificar o caminho real e garantir que ele está dentro do diretório esperado. Alternativamente, configure permissões restritivas em diretórios temporários (use sticky bit em /tmp, ou crie diretórios privados) para impedir que outros usuários injetem symlinks maliciosos.

CVE-2025-62596HIGHyouki container escape and denial of service due to arbitrary write gadgets and procfs write redirectsEPSS 0.2%CVE-2026-34447MEDIUMONNX: External Data Symlink TraversalEPSS 0.2%CVE-2025-11489LOWwonderwhy-er DesktopCommanderMCP filesystem.ts isPathAllowed symlinkEPSS 0.2%CVE-2024-23285HIGHThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sonoma 14.4. An app may be able to create symlinksEPSS 0.2%CVE-2025-62161HIGHyouki container escape via "masked path" abuse due to mount race conditionsEPSS 0.2%CVE-2026-31893MEDIUMTunnelblick arbitrary file read via symlink following in tunnelblickdEPSS 0.2%CVE-2026-53802HIGHrsync < 3.5.0 Arbitrary File Read via Symlink FollowingEPSS 0.2%CVE-2024-44132HIGHThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15. An app may be able to break out of itsEPSS 0.2%CVE-2026-23968MEDIUMCopier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: falseEPSS 0.2%CVE-2025-65105MEDIUMApptainer ineffective application of selinux and apparmor --security optionsEPSS 0.2%CVE-2026-39822HIGHRoot escape via symlink plus trailing slash in osEPSS 0.2%CVE-2026-27485MEDIUMOpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injectionEPSS 0.2%CVE-2026-24018HIGHA UNIX symbolic link (Symlink) following vulnerability in Fortinet FortiClientLinux 7.4.0 through 7.4.4, FortiClientLinux 7.2.2 through 7.2.EPSS 0.2%CVE-2026-13201HIGHKubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruptionEPSS 0.2%CVE-2025-14693HIGHUgreen DH2100+ USB symlinkEPSS 0.2%CVE-2026-47763MEDIUMpdm: Project-Local State and Config Writes Follow SymlinksEPSS 0.2%CVE-2026-1386MEDIUMArbitrary Host File Overwrite via Symlink in Firecracker JailerEPSS 0.2%CVE-2025-59825MEDIUMastral-tokio-tar has a path traversal in tar extractionEPSS 0.2%CVE-2024-52522MEDIUMRclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadataEPSS 0.2%CVE-2024-1933HIGHImproper symlink resolution in TeamViewer Remote client for macOSEPSS 0.2%