Falhas do tipo CWE-59

823 resultados

Seguimento de links simbólicos (symlink)

A aplicação segue links simbólicos sem validação, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Isso pode resultar em leitura, modificação ou exclusão de arquivos sensíveis fora do diretório esperado.

Exemplo

Um servidor web processa uploads em /tmp/uploads/, mas não verifica se os caminhos são links simbólicos. Um atacante cria um symlink em /tmp/uploads/config que aponta para /etc/passwd, e a aplicação sobrescreve o arquivo de senhas do sistema.

Como mitigar

Use funções que resolvem caminhos canônicos (realpath em C, Path.toRealPath() em Java) antes de qualquer operação com arquivo, e implemente verificações de TOCTOU (time-of-check-time-of-use). Mantenha operações sensíveis em diretórios controlados com permissões restritivas e evite processar symlinks vindos de áreas com controle de usuário.

CVE-2013-4392MEDIUMsystemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via EPSS 0.5%CVE-2023-42137HIGHPAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow for command execution with high privileEPSS 0.5%CVE-2020-8095MEDIUMBitdefender Total Security Link Resolution Denial-of-Service VulnerabilityEPSS 0.5%CVE-2026-13723MEDIUMDevelar's electron-builder allows arbitrary file overwriteEPSS 0.5%CVE-2026-34242HIGHWeblate: Arbitrary File Read via SymlinkEPSS 0.5%CVE-2023-35320HIGHConnected User Experiences and Telemetry Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2026-86861MEDIUMpgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment checkEPSS 0.5%CVE-2019-10152HIGHA path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacEPSS 0.5%CVE-2026-33748HIGHBuildKit Git URL subdir component can cause access to restricted filesEPSS 0.5%CVE-2020-15861HIGHNet-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following.EPSS 0.5%CVE-2026-45405CRITICALDokku: Arbitrary File Write via Tar Symlink Traversal in git:from-archive and certs:addEPSS 0.5%CVE-2023-2939HIGHInsufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a local attacker to perform privilege eEPSS 0.5%CVE-2026-59944MEDIUMComposer: CVE-2026-59946 fix bypass via symlinked package bin pathEPSS 0.5%CVE-2026-70460CRITICALrsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir SymlinkEPSS 0.4%CVE-2026-49180MEDIUMUniversal Plug and Play (upnp.dll) Information Disclosure VulnerabilityEPSS 0.4%CVE-2026-29786HIGHnode-tar: Hardlink Path Traversal via Drive-Relative LinkpathEPSS 0.4%CVE-2020-8099HIGHLink Resolution Privilege Escalation Vulnerability in Bitdefender Antivirus Free (VA-8387)EPSS 0.4%CVE-2023-36568HIGHMicrosoft Office Click-To-Run Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2008-4996MEDIUMinit in initramfs-tools 0.92f allows local users to overwrite arbitrary files via a symlink attack on the /tmp/initramfs.debug temporary filEPSS 0.4%CVE-2026-44340HIGHPraisonAI: Symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`EPSS 0.4%