Fallos del tipo CWE-59

823 resultados

Seguimento de links simbólicos (symlink race condition)

Ocorre quando uma aplicação opera sobre um arquivo sem validar se ele é um link simbólico, permitindo que um atacante redirecione a operação para um arquivo arbitrário no sistema. O código assume que está acessando um arquivo legítimo, mas na verdade está sendo manipulado para acessar (ler, escrever ou deletar) qualquer outro arquivo que a aplicação tenha permissão.

Ejemplo

Um script de limpeza temporária com privilégios de root deleta arquivos em /tmp/cache/ sem verificar se são links simbólicos. Um atacante cria um link /tmp/cache/dados → /etc/passwd e consegue deletar arquivos críticos do sistema. Ou um backup toca em /tmp/file, que é na verdade um symlink para /home/usuario/.ssh/id_rsa, expondo a chave privada.

Cómo mitigar

Use funções seguras que não seguem symlinks (como `lstat()` em vez de `stat()` no Linux), valide se o caminho é um link antes de operar, use `O_NOFOLLOW` em `open()`, ou execute operações em diretórios com permissões restritivas (apenas proprietário pode criar arquivos). Em ambientes críticos, considere usar containers ou jails.

CVE-2025-52936CRITICALImproper Link Resolution Before File Access vulnerability in yrutschle/sslhEPSS 0.2%CVE-2025-9870HIGHRazer Synapse 3 RazerPhilipsHueUninstall Link Following Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-9869HIGHRazer Synapse 3 Macro Module Link Following Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-9871HIGHRazer Synapse 3 Chroma Connect Link Following Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2025-15313MEDIUMTanium addressed an arbitrary file deletion vulnerability in Tanium EUSS.EPSS 0.2%CVE-2026-27748HIGHAvira Internet Security Arbitrary File Deletion via Improper Link ResolutionEPSS 0.2%CVE-2025-12838HIGHMSP360 Free Backup Link Following Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2024-54554MEDIUMThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.1. An app may be able to access sensitiEPSS 0.2%CVE-2025-30240MEDIUMArbitrary File Read via Improper Symlink Handling in USB HTTPS Access Path in multiple TP-Link Aginet DevicesEPSS 0.2%CVE-2025-62363HIGHyt-grabber-tui allows arbitrary code execution via configurable yt-dlp pathEPSS 0.2%CVE-2023-6336HIGHImproper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Workforce Access on MacOS allows User-Controlled FilenaEPSS 0.2%CVE-2026-64613MEDIUMData::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOWEPSS 0.2%CVE-2025-43288MEDIUMThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An app may be ableEPSS 0.2%CVE-2025-29983MEDIUMDell Trusted Device, versions prior to 7.0.3.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A lEPSS 0.2%CVE-2025-15328MEDIUMTanium addressed an improper link resolution before file access vulnerability in Enforce.EPSS 0.2%CVE-2026-55086MEDIUMEtherpad: Import/export use Math.random() for temp file paths; predictable paths on shared /tmp enable symlink-based file overwriteEPSS 0.2%CVE-2026-44269MEDIUMDell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1EPSS 0.2%CVE-2026-14699MEDIUMzcaceres markdownify-mcp Markdownify.ts assertPathAllowed symlinkEPSS 0.2%CVE-2026-44274HIGHDell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution Before File Access vulnerability. A low prEPSS 0.2%CVE-2026-46468MEDIUMDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1EPSS 0.2%