Falhas do tipo CWE-59

823 resultados

Seguimento de links simbólicos (symlink)

A aplicação segue links simbólicos sem validação, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Isso pode resultar em leitura, modificação ou exclusão de arquivos sensíveis fora do diretório esperado.

Exemplo

Um servidor web processa uploads em /tmp/uploads/, mas não verifica se os caminhos são links simbólicos. Um atacante cria um symlink em /tmp/uploads/config que aponta para /etc/passwd, e a aplicação sobrescreve o arquivo de senhas do sistema.

Como mitigar

Use funções que resolvem caminhos canônicos (realpath em C, Path.toRealPath() em Java) antes de qualquer operação com arquivo, e implemente verificações de TOCTOU (time-of-check-time-of-use). Mantenha operações sensíveis em diretórios controlados com permissões restritivas e evite processar symlinks vindos de áreas com controle de usuário.

CVE-2021-23177—An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. AEPSS 0.4%CVE-2018-1063—Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinEPSS 0.4%CVE-2026-82252HIGHgitoxide before 0.52.1 Repository Boundary Violation via symlinked .gitmodulesEPSS 0.4%CVE-2021-31566—An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of EPSS 0.4%CVE-2019-18897HIGHLocal privilege escalation from user salt to rootEPSS 0.4%CVE-2024-7239HIGHVIPRE Advanced Security Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2024-7233HIGHAvast Free Antivirus AvastSvc Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2024-8404HIGHArbitrary File Deletion in PaperCut NG/MF Web Print Hot folderEPSS 0.4%CVE-2024-7232HIGHAvast Free Antivirus AvastSvc Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-14966LOWSymlink guard bypass in unarchive module allows planting symlinks during extractionEPSS 0.4%CVE-2024-7240HIGHF-Secure Total Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-49791HIGHWindows Routing and Remote Access Service (RRAS) Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2019-18901MEDIUMmysql-systemd-helper allows setting 640 permissions of arbitrary filesEPSS 0.4%CVE-2024-5928HIGHVIPRE Advanced Security PMAgent Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2026-55668MEDIUMFile Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scopeEPSS 0.4%CVE-2023-21725MEDIUMWindows Malicious Software Removal Tool Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2026-62189HIGHOpenClaw < 2026.6.9 Symlink Following via Mirror SyncEPSS 0.4%CVE-2026-53783HIGHrsync < 3.5.0 TOCTOU Race Condition Directory Escape via rrsyncEPSS 0.4%CVE-2026-34604HIGH@tinacms/graphql's `FilesystemBridge` Path Validation Can Be Bypassed via Symlinks or JunctionsEPSS 0.4%CVE-2026-62803HIGHWindows DHCP Server Elevation of Privilege VulnerabilityEPSS 0.4%