Falhas do tipo CWE-59

823 resultados

Seguimento de links simbólicos (symlink)

A aplicação segue links simbólicos sem validação, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Isso pode resultar em leitura, modificação ou exclusão de arquivos sensíveis fora do diretório esperado.

Exemplo

Um servidor web processa uploads em /tmp/uploads/, mas não verifica se os caminhos são links simbólicos. Um atacante cria um symlink em /tmp/uploads/config que aponta para /etc/passwd, e a aplicação sobrescreve o arquivo de senhas do sistema.

Como mitigar

Use funções que resolvem caminhos canônicos (realpath em C, Path.toRealPath() em Java) antes de qualquer operação com arquivo, e implemente verificações de TOCTOU (time-of-check-time-of-use). Mantenha operações sensíveis em diretórios controlados com permissões restritivas e evite processar symlinks vindos de áreas com controle de usuário.

CVE-2026-81963HIGHWindows Update Stack Elevation of Privilege VulnerabilityEPSS 0.6%KEVCVE-2023-34204MEDIUMimapsync through 2.229 uses predictable paths under /tmp and /var/tmp in its default mode of operation. Both of these are typically world-wrEPSS 0.6%CVE-2023-35379HIGHReliability Analysis Metrics Calculation Engine (RACEng) Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2024-44264HIGHThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS VenturaEPSS 0.6%CVE-2025-25185HIGHGPT Academic allows arbitary file read by tarfile uncompress within softlinkEPSS 0.6%CVE-2023-24904HIGHWindows Installer Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2026-46464MEDIUMDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1EPSS 0.6%CVE-2024-1329HIGHNomad Vulnerable to Arbitrary Write Through Symlink AttackEPSS 0.6%CVE-2024-36306MEDIUMA link following vulnerability in the Trend Micro Apex One and Apex One as a Service Damage Cleanup Engine could allow a local attacker to cEPSS 0.6%CVE-2025-55247HIGH.NET Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2025-25008HIGHWindows Server Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2026-41610MEDIUMVisual Studio Code Security Feature Bypass VulnerabilityEPSS 0.6%CVE-2019-12672MEDIUMCisco IOS XE Software Arbitrary Code Execution VulnerabilityEPSS 0.6%CVE-2025-33075HIGHWindows Installer Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2017-12172—PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runsEPSS 0.6%CVE-2026-71476HIGHNx: Zip-Slip in the self-hosted remote cacheEPSS 0.6%CVE-2023-21678HIGHWindows Print Spooler Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2024-38188HIGHAzure Network Watcher VM Agent Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2024-28907HIGHMicrosoft Brokering File System Elevation of Privilege VulnerabilityEPSS 0.6%CVE-2024-38022HIGHWindows Image Acquisition Elevation of Privilege VulnerabilityEPSS 0.6%