Falhas do tipo CWE-59

823 resultados

Seguimento de links simbólicos (symlink)

A aplicação segue links simbólicos sem validação, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Isso pode resultar em leitura, modificação ou exclusão de arquivos sensíveis fora do diretório esperado.

Exemplo

Um servidor web processa uploads em /tmp/uploads/, mas não verifica se os caminhos são links simbólicos. Um atacante cria um symlink em /tmp/uploads/config que aponta para /etc/passwd, e a aplicação sobrescreve o arquivo de senhas do sistema.

Como mitigar

Use funções que resolvem caminhos canônicos (realpath em C, Path.toRealPath() em Java) antes de qualquer operação com arquivo, e implemente verificações de TOCTOU (time-of-check-time-of-use). Mantenha operações sensíveis em diretórios controlados com permissões restritivas e evite processar symlinks vindos de áreas com controle de usuário.

CVE-2026-44340HIGHPraisonAI: Symlink-extraction bypass of `_safe_extractall` writes outside `dest_dir`EPSS 0.4%CVE-2026-42496CRITICALArchive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directoryEPSS 0.4%CVE-2021-23872HIGHPrivilege Escalation vulnerability in McAfee Total Protection (MTP)EPSS 0.4%CVE-2026-71493MEDIUMInfracost: Arbitrary file read via config-template readFile symlink traversalEPSS 0.4%CVE-2026-15629MEDIUMlouisho5 picobot Workspace filesystem.go GetSkill link followingEPSS 0.4%CVE-2024-49059HIGHMicrosoft Office Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-70348MEDIUMWindows Management Services Denial of Service VulnerabilityEPSS 0.4%CVE-2019-18232—SafeNet Sentinel LDK License Manager, all versions prior to 7.101(only Microsoft Windows versions are affected) is vulnerable when configureEPSS 0.4%CVE-2019-3690MEDIUMchkstat follows untrusted symbolic linksEPSS 0.4%CVE-2019-3694HIGHLocal privilege escalation from munin to root in the packaging of muninEPSS 0.4%CVE-2026-42497HIGHArchive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directoryEPSS 0.4%CVE-2026-44881HIGHPortainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-UpdateEPSS 0.4%CVE-2026-47187CRITICALSSHFS Symlink Escape: Rogue SFTP Server → Local File Read/WriteEPSS 0.4%CVE-2017-7500HIGHIt was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changinEPSS 0.4%CVE-2025-0413HIGHParallels Desktop Technical Data Reporter Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2025-23010HIGHAn Improper Link Resolution Before File Access ('Link Following') vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client whicEPSS 0.4%CVE-2025-55317HIGHMicrosoft AutoUpdate (MAU) Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-90930HIGHFile Browser through 2.63.23 Path Traversal via Symlink AliasEPSS 0.4%CVE-2026-31894MEDIUMWeGIA affected by arbitrary file read via symlink in backup restoreEPSS 0.4%CVE-2025-55245HIGHXbox Gaming Services Elevation of Privilege VulnerabilityEPSS 0.4%