Fallos del tipo CWE-61

197 resultados

Seguimento de ligações simbólicas em UNIX

Fraqueza onde uma aplicação segue uma ligação simbólica (symlink) sem validar adequadamente, permitindo que um atacante redirecione operações de arquivo para locais não intencionais. Um processo com privilégios elevados pode acabar lendo, escrevendo ou deletando arquivos críticos do sistema ao seguir um symlink malicioso criado pelo atacante.

Ejemplo

Um script de limpeza executado como root tenta remover arquivos em /tmp/cache sem verificar se são symlinks. Um atacante cria um symlink em /tmp/cache apontando para /etc/passwd, e o script acaba deletando a credencial do sistema. Ou um programa tenta criar um arquivo de log em /tmp sem checar se /tmp/app.log já é um symlink para /etc/shadow.

Cómo mitigar

Use funções seguras como open() com flags O_NOFOLLOW, lstat() em vez de stat(), ou valide o caminho com realpath() antes de operar. Em shell scripts, use [[ -L file ]] para detectar symlinks. Mantenha /tmp e /var/tmp com sticky bit (1777) e evite TOCTOU—verifique e acesse atomicamente ou use descritores de arquivo.

CVE-2026-49248HIGHOneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untarEPSS 0.6%CVE-2021-39135HIGHUNIX Symbolic Link (Symlink) Following in @npmcli/arboristEPSS 0.6%CVE-2024-47515HIGHPagure: generate_archive() follows symbolic links in temporary clonesEPSS 0.6%CVE-2024-52535HIGHDell SupportAssist for Home PCs versions 4.6.1 and prior and Dell SupportAssist for Business PCs versions 4.5.0 and prior, contain a symboliEPSS 0.6%CVE-2024-47877MEDIUMExtract has insufficient checks allowing attacker to create symlinks outside the extraction directory.EPSS 0.5%CVE-2026-24047MEDIUM@backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain BypassEPSS 0.5%CVE-2026-62992MEDIUMSmarty: Symlink path traversal out of trusted directoriesEPSS 0.5%CVE-2026-56876HIGHextract-zip unvalidated symlink path traversalEPSS 0.5%CVE-2020-8019HIGHsyslog-ng: Local privilege escalation from new to root in %postEPSS 0.5%CVE-2025-68937CRITICALForgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-EPSS 0.5%CVE-2020-8014HIGHkopano-python-services: Local privilege escalation from kopano to root in kopano-spamd subpackageEPSS 0.5%CVE-2026-29203MEDIUMA chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system filEPSS 0.5%CVE-2025-24886HIGHpwn.college has Symlink LFI in Dojo reposEPSS 0.5%CVE-2024-45418MEDIUMZoom Apps for macOS - Symbolic Link FollowingEPSS 0.5%CVE-2026-25724LOWClaude Code Has Permission Deny Bypass Through Symbolic LinksEPSS 0.5%CVE-2026-52811CRITICALGogs: UploadRepoFiles writes outside repo working tree via committed parent symEPSS 0.5%CVE-2026-57825MEDIUMIn the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .EPSS 0.5%CVE-2026-97024HIGHFlatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etcEPSS 0.5%CVE-2026-17459MEDIUMperwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlinkEPSS 0.5%CVE-2026-97023HIGHFlatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/binEPSS 0.5%