Falhas do tipo CWE-59

823 resultados

Seguimento de links simbólicos (symlink)

A aplicação segue links simbólicos sem validação, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Isso pode resultar em leitura, modificação ou exclusão de arquivos sensíveis fora do diretório esperado.

Exemplo

Um servidor web processa uploads em /tmp/uploads/, mas não verifica se os caminhos são links simbólicos. Um atacante cria um symlink em /tmp/uploads/config que aponta para /etc/passwd, e a aplicação sobrescreve o arquivo de senhas do sistema.

Como mitigar

Use funções que resolvem caminhos canônicos (realpath em C, Path.toRealPath() em Java) antes de qualquer operação com arquivo, e implemente verificações de TOCTOU (time-of-check-time-of-use). Mantenha operações sensíveis em diretórios controlados com permissões restritivas e evite processar symlinks vindos de áreas com controle de usuário.

CVE-2026-41364HIGHOpenClaw < 2026.3.31 - Arbitrary File Write via Symlink Following in SSH Sandbox Tar UploadEPSS 0.5%CVE-2023-36876HIGHReliability Analysis Metrics Calculation (RacTask) Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-24046HIGHBackstage has a Possible Symlink Path Traversal in Scaffolder ActionsEPSS 0.5%CVE-2026-61371HIGHMicrosoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symEPSS 0.5%CVE-2020-8015HIGHLocal privilege escalation in exim package from user mail to rootEPSS 0.5%CVE-2026-55168MEDIUMRuntipi: Authenticated arbitrary file write via backup restore symlink plantingEPSS 0.5%CVE-2018-6954HIGHsystemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain owneEPSS 0.5%CVE-2020-6012—ZoneAlarm Anti-Ransomware before version 1.0.713 copies files for the report from a directory with low privileges. A sophisticated timed attEPSS 0.5%CVE-2023-35353HIGHConnected User Experiences and Telemetry Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2019-3691HIGHLocal privilege escalation from user munge to rootEPSS 0.5%CVE-2019-3697HIGHLocal privilege escalation from user gnump3d to rootEPSS 0.5%CVE-2025-41667HIGHPhoenix Contact: File access due to the replacement of a critical file used by the arp-preinit scriptEPSS 0.5%CVE-2023-32178HIGHVIPRE Antivirus Plus TelFileTransfer Link Following Local Privilege Escalation VulnerabilityEPSS 0.5%CVE-2023-32179HIGHVIPRE Antivirus Plus FPQuarTransfer Link Following Local Privilege Escalation VulnerabilityEPSS 0.5%CVE-2026-9804HIGHKubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file readEPSS 0.5%CVE-2021-35938—A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unpEPSS 0.5%CVE-2025-41666HIGHPhoenix Contact: File access due to the replacement of a critical file used by the watchdogEPSS 0.5%CVE-2025-41668HIGHPhoenix Contact: File access due to the replacement of a critical file used by the service security-profileEPSS 0.5%CVE-2025-29975HIGHMicrosoft PC Manager Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2023-32175HIGHVIPRE Antivirus Plus Link Following Local Privilege Escalation VulnerabilityEPSS 0.5%