Fallos del tipo CWE-61

197 resultados

Seguimento de ligações simbólicas em UNIX

Fraqueza onde uma aplicação segue uma ligação simbólica (symlink) sem validar adequadamente, permitindo que um atacante redirecione operações de arquivo para locais não intencionais. Um processo com privilégios elevados pode acabar lendo, escrevendo ou deletando arquivos críticos do sistema ao seguir um symlink malicioso criado pelo atacante.

Ejemplo

Um script de limpeza executado como root tenta remover arquivos em /tmp/cache sem verificar se são symlinks. Um atacante cria um symlink em /tmp/cache apontando para /etc/passwd, e o script acaba deletando a credencial do sistema. Ou um programa tenta criar um arquivo de log em /tmp sem checar se /tmp/app.log já é um symlink para /etc/shadow.

Cómo mitigar

Use funções seguras como open() com flags O_NOFOLLOW, lstat() em vez de stat(), ou valide o caminho com realpath() antes de operar. Em shell scripts, use [[ -L file ]] para detectar symlinks. Mantenha /tmp e /var/tmp com sticky bit (1777) e evite TOCTOU—verifique e acesse atomicamente ou use descritores de arquivo.

CVE-2026-56815HIGHpwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in the upload handler in Components/Pages/HomEPSS 0.2%CVE-2025-64750MEDIUMSingluarity ineffectively applies of selinux / apparmor LSM process labelsEPSS 0.2%CVE-2026-32657HIGHDell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1, Dell VxRail Version 8.0.322, Dell PowerMax VersionEPSS 0.2%CVE-2026-79939MEDIUMDell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged EPSS 0.2%CVE-2026-59674HIGHLPE from suricata user to root due to chown in %post in suricata packagingEPSS 0.2%CVE-2025-53881MEDIUMSUSE-specific logrotate configuration allows escalation from mail user/group to rootEPSS 0.2%CVE-2026-22767HIGHDell AppSync, version(s) 4.6.0, contain(s) an UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local accEPSS 0.2%CVE-2025-46810HIGHA UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate EPSS 0.2%CVE-2026-108981LOWngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., EPSS 0.2%CVE-2026-115424MEDIUMOc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destinationEPSS 0.2%CVE-2026-75038MEDIUMPredictable temporary file in /tmp allows symlink attack in LACTEPSS 0.2%CVE-2026-77159MEDIUMLibvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlinkEPSS 0.2%CVE-2025-1079HIGHRCE In Google Web DesignerEPSS 0.2%CVE-2026-8784MEDIUMnpitre cramfs-tools cramfsck.c change_file_status symlinkEPSS 0.2%CVE-2023-39246MEDIUM Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server version prior to 11.8.1 contain an Insecure OEPSS 0.2%CVE-2026-100395MEDIUMLXC: lxc-copy host-context hostname update follows symlinkEPSS 0.2%CVE-2025-43278MEDIUMThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protectEPSS 0.2%CVE-2026-13218MEDIUMKubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcherEPSS 0.1%CVE-2026-121520MEDIUMMalicious client could set xattr value outside of BuildKit state directoryEPSS 0.1%CVE-2026-12080HIGHQemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keysEPSS 0.1%