Weaknesses of type CWE-61

173 results

Seguimento de link simbólico UNIX não validado

Uma aplicação segue um link simbólico (symlink) sem validar para onde ele aponta, permitindo que um atacante redirecione operações de arquivo para locais arbitrários do sistema. Se o programa tem privilégios elevados, o atacante consegue ler, modificar ou deletar arquivos sensíveis fora do escopo pretendido.

Example

Um script de backup roda como root e processa arquivos em /tmp/dados. Um atacante cria um symlink /tmp/dados → /etc/passwd. Quando o script segue o link, ele acaba manipulando o arquivo de senhas do sistema em vez do arquivo de dados esperado.

How to mitigate

Valide symlinks antes de operar sobre eles: use funções como `realpath()` ou `readlink()` para verificar o caminho real e garantir que ele está dentro do diretório esperado. Alternativamente, configure permissões restritivas em diretórios temporários (use sticky bit em /tmp, ou crie diretórios privados) para impedir que outros usuários injetem symlinks maliciosos.

CVE-2024-34015LOWSensitive information disclosure during file browsing due to improper symbolic link handling. The following products are affected: Acronis BEPSS 0.2%CVE-2025-62724MEDIUMOpen OnDemand allowlist bypass using symlinks in directory downloads (TOCTOU)EPSS 0.2%CVE-2026-20694MEDIUMThis issue was addressed with improved handling of symlinks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS SeEPSS 0.2%CVE-2024-34014MEDIUMArbitrary file overwrite during recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin EPSS 0.2%CVE-2025-24832MEDIUMArbitrary file overwrite during home directory recovery due to improper symbolic link handling. The following products are affected: AcronisEPSS 0.2%CVE-2023-20091MEDIUMCisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Overwrite VulnerabilityEPSS 0.2%CVE-2023-20093MEDIUMCisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Overwrite VulnerabilityEPSS 0.2%CVE-2023-20092MEDIUMCisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Overwrite VulnerabilityEPSS 0.2%CVE-2024-47480HIGHDell Inventory Collector Client, versions prior to 12.7.0, contains an Improper Link Resolution Before File Access vulnerability. A low-privEPSS 0.2%CVE-2026-39860CRITICALNix sandbox escape: file write via symlink at FOD `.tmp` copy destinationEPSS 0.2%CVE-2024-39578MEDIUMDell PowerScale OneFS versions 8.2.2.x through 9.8.0.1 contains a UNIX symbolic link (symlink) following vulnerability. A local high privileEPSS 0.2%CVE-2026-12958HIGHArbitrary file write in Language Servers for AWSEPSS 0.2%CVE-2024-25953MEDIUMDell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privilEPSS 0.2%CVE-2024-25952MEDIUMDell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privilEPSS 0.2%CVE-2026-41579LOWrunc: Malicious image with /dev symlink can trigger limited host filesystem integrity violationsEPSS 0.2%CVE-2026-13748MEDIUMSnowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path RestrictionEPSS 0.2%CVE-2026-12080HIGHQemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keysEPSS 0.2%CVE-2025-22480HIGHDell SupportAssist OS Recovery versions prior to 5.5.13.1 contain a symbolic link attack vulnerability. A low-privileged attacker with localEPSS 0.2%CVE-2025-54867HIGHYouki Symlink Following VulnerabilityEPSS 0.2%CVE-2026-34446MEDIUMONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX loadEPSS 0.2%