Fallos del tipo CWE-59

823 resultados

Seguimento de links simbólicos (symlink race condition)

Ocorre quando uma aplicação opera sobre um arquivo sem validar se ele é um link simbólico, permitindo que um atacante redirecione a operação para um arquivo arbitrário no sistema. O código assume que está acessando um arquivo legítimo, mas na verdade está sendo manipulado para acessar (ler, escrever ou deletar) qualquer outro arquivo que a aplicação tenha permissão.

Ejemplo

Um script de limpeza temporária com privilégios de root deleta arquivos em /tmp/cache/ sem verificar se são links simbólicos. Um atacante cria um link /tmp/cache/dados → /etc/passwd e consegue deletar arquivos críticos do sistema. Ou um backup toca em /tmp/file, que é na verdade um symlink para /home/usuario/.ssh/id_rsa, expondo a chave privada.

Cómo mitigar

Use funções seguras que não seguem symlinks (como `lstat()` em vez de `stat()` no Linux), valide se o caminho é um link antes de operar, use `O_NOFOLLOW` em `open()`, ou execute operações em diretórios com permissões restritivas (apenas proprietário pode criar arquivos). Em ambientes críticos, considere usar containers ou jails.

CVE-2023-32012HIGHWindows Container Manager Service Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2021-35939—It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of theEPSS 0.5%CVE-2026-63125CRITICALIncus vulnerable to root RCE via image backup.yaml symlinkEPSS 0.5%CVE-2014-1420LOWInsecure temp file usage in Ubuntu UI toolkitEPSS 0.5%CVE-2026-54094HIGHFile Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scopeEPSS 0.5%CVE-2023-35347HIGHMicrosoft Install Service Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-59510MEDIUMWindows Routing and Remote Access Service (RRAS) Denial of Service VulnerabilityEPSS 0.5%CVE-2025-43252MEDIUMThis issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sequoia 15.6. A website may be able tEPSS 0.5%CVE-2019-3692HIGHLocal privilege escalation from user news to root in the packaging of innEPSS 0.5%CVE-2024-21397MEDIUMMicrosoft Azure File Sync Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-65647HIGHImproper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.EPSS 0.5%CVE-2023-35342HIGHWindows Image Acquisition Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2020-28935—Local symlink attack in Unbound and NSDEPSS 0.5%CVE-2026-55667HIGHFile Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanupEPSS 0.5%CVE-2026-54352CRITICALBudibase: Arbitrary file read by workspace-builder via PWA-zip symlink uploadEPSS 0.5%CVE-2024-30060HIGHAzure Monitor Agent Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2024-1753HIGHBuildah: full container escape at build timeEPSS 0.5%CVE-2026-24056MEDIUMpnpm has symlink traversal in file:/git dependenciesEPSS 0.5%CVE-2025-57749MEDIUMn8n has a symlink traversal vulnerability in "Read/Write File" node allows access to restricted filesEPSS 0.5%CVE-2026-81690HIGHverify-usb before 1.4.9 Symlink Directory Traversal Code ExecutionEPSS 0.5%