Falhas do tipo CWE-59

823 resultados

Seguimento de links simbólicos (symlink)

A aplicação segue links simbólicos sem validação, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Isso pode resultar em leitura, modificação ou exclusão de arquivos sensíveis fora do diretório esperado.

Exemplo

Um servidor web processa uploads em /tmp/uploads/, mas não verifica se os caminhos são links simbólicos. Um atacante cria um symlink em /tmp/uploads/config que aponta para /etc/passwd, e a aplicação sobrescreve o arquivo de senhas do sistema.

Como mitigar

Use funções que resolvem caminhos canônicos (realpath em C, Path.toRealPath() em Java) antes de qualquer operação com arquivo, e implemente verificações de TOCTOU (time-of-check-time-of-use). Mantenha operações sensíveis em diretórios controlados com permissões restritivas e evite processar symlinks vindos de áreas com controle de usuário.

CVE-2026-69289HIGHWindows Setup Files Cleanup Elevation of Privilege VulnerabilityEPSS 0.4%CVE-2025-32817MEDIUMA Improper Link Resolution vulnerability (CWE-59) in the SonicWall Connect Tunnel Windows (32 and 64 bit) client, this results in unauthorizEPSS 0.4%CVE-2026-42574HIGHapko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build rootEPSS 0.4%CVE-2024-7227HIGHAvast Free Antivirus AvastSvc Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2024-7234HIGHAVG AntiVirus Free AVGSvc Link Following Local Privilege Escalation VulnerabilityEPSS 0.4%CVE-2021-44730HIGHsnapd could be made to escalate privileges and run programs as administratorEPSS 0.4%CVE-2025-15314MEDIUMTanium addressed an arbitrary file deletion vulnerability in end-user-cx.EPSS 0.4%CVE-2026-59311MEDIUMFixed predictable /tmp/ziptransformer work directory enables symlink pre-creationEPSS 0.4%CVE-2020-3237MEDIUMCisco IOx Application Framework Arbitrary File Overwrite VulnerabilityEPSS 0.4%CVE-2026-35025HIGHProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFREPSS 0.3%CVE-2026-24884HIGHCompressing Vulnerable to Arbitrary File Write via Symlink ExtractionEPSS 0.3%CVE-2024-5742MEDIUMNano: running `chmod` and `chown` on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned fileEPSS 0.3%CVE-2026-50163HIGHoras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extractionEPSS 0.3%CVE-2013-0261HIGHPackstack: packstack: arbitrary file overwrite via symlink attackEPSS 0.3%CVE-2025-59241HIGHWindows Health and Optimized Experiences Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2024-7237HIGHAVG AntiVirus Free AVGSvc Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2020-6015—Check Point Endpoint Security for Windows before E84.10 can reach denial of service during clean install of the client which will prevent thEPSS 0.3%CVE-2024-7229HIGHAvast Cleanup Premium Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-19008MEDIUMmf-yang openclaw-cn apply_patch Tool sandbox-paths.ts assertNoSymlinkEscape link followingEPSS 0.3%CVE-2024-7231HIGHAvast Cleanup Premium Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%