Fallos del tipo CWE-59

823 resultados

Seguimento de links simbólicos (symlink race condition)

Ocorre quando uma aplicação opera sobre um arquivo sem validar se ele é um link simbólico, permitindo que um atacante redirecione a operação para um arquivo arbitrário no sistema. O código assume que está acessando um arquivo legítimo, mas na verdade está sendo manipulado para acessar (ler, escrever ou deletar) qualquer outro arquivo que a aplicação tenha permissão.

Ejemplo

Um script de limpeza temporária com privilégios de root deleta arquivos em /tmp/cache/ sem verificar se são links simbólicos. Um atacante cria um link /tmp/cache/dados → /etc/passwd e consegue deletar arquivos críticos do sistema. Ou um backup toca em /tmp/file, que é na verdade um symlink para /home/usuario/.ssh/id_rsa, expondo a chave privada.

Cómo mitigar

Use funções seguras que não seguem symlinks (como `lstat()` em vez de `stat()` no Linux), valide se o caminho é um link antes de operar, use `O_NOFOLLOW` em `open()`, ou execute operações em diretórios com permissões restritivas (apenas proprietário pode criar arquivos). Em ambientes críticos, considere usar containers ou jails.

CVE-2025-43461MEDIUMThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS Tahoe 26.1. An app may be able to access protectEPSS 0.2%CVE-2026-6941MEDIUMradare2 < 6.1.4 Project Notes Path Traversal via SymlinkEPSS 0.2%CVE-2025-68146MEDIUMfilelock has TOCTOU race condition that allows symlink attacks during lock file creationEPSS 0.2%CVE-2025-20003HIGHImproper link resolution before file access ('Link Following') for some Intel(R) Graphics Driver software installers may allow an authenticaEPSS 0.2%CVE-2025-9968HIGHA link following vulnerability exists in the UnifyScanner component of Armoury Crate. This vulnerability may be triggered by creating a specEPSS 0.2%CVE-2025-15543MEDIUMRead-Only Root Access via USB Storage Device in TP-Link VX800vEPSS 0.2%CVE-2026-31979HIGHhimmelblaud-tasks: local privilege escalation via /tmp symlink attack on Kerberos ccacheEPSS 0.2%CVE-2025-43381MEDIUMThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26.1. A malicious app may be able to delete EPSS 0.2%CVE-2026-82331CRITICALApache BuildStream: tar source extraction escapeEPSS 0.2%CVE-2021-23892HIGHBy exploiting a time of check to time of use (TOCTOU) race condition during the Endpoint Security for Linux Threat Prevention and Firewall (EPSS 0.2%CVE-2024-11857HIGHRealtek Bluetooth HCI Adaptor - Privilege EscalationEPSS 0.2%CVE-2026-41433HIGHOpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIREPSS 0.2%CVE-2026-15684HIGHGlarysoft Glary Utilities Link Following Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2023-20004MEDIUMCisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Write VulnerabilityEPSS 0.2%CVE-2023-20008MEDIUMA vulnerability in the CLI of Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to overwrite arbitrary EPSS 0.2%CVE-2026-62239MEDIUMFlashAttention Symlink Attack via tarfile.extractall in hopper/setup.pyEPSS 0.2%CVE-2026-45403LOWAnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directoryEPSS 0.2%CVE-2026-53785MEDIUMrsync < 3.5.0 Path Traversal Write Escape via --relative ModeEPSS 0.2%CVE-2025-34352HIGHJumpCloud Remote Assist < 0.317.0 Arbitrary File Write/Delete via Insecure Temp DirectoryEPSS 0.2%CVE-2025-30641HIGHA link following vulnerability in the anti-malware solution portion of Trend Micro Deep Security 20.0 agents could allow a local attacker toEPSS 0.2%