Falhas do tipo CWE-59

823 resultados

Seguimento de links simbólicos (symlink)

A aplicação segue links simbólicos sem validação, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Isso pode resultar em leitura, modificação ou exclusão de arquivos sensíveis fora do diretório esperado.

Exemplo

Um servidor web processa uploads em /tmp/uploads/, mas não verifica se os caminhos são links simbólicos. Um atacante cria um symlink em /tmp/uploads/config que aponta para /etc/passwd, e a aplicação sobrescreve o arquivo de senhas do sistema.

Como mitigar

Use funções que resolvem caminhos canônicos (realpath em C, Path.toRealPath() em Java) antes de qualquer operação com arquivo, e implemente verificações de TOCTOU (time-of-check-time-of-use). Mantenha operações sensíveis em diretórios controlados com permissões restritivas e evite processar symlinks vindos de áreas com controle de usuário.

CVE-2026-19008MEDIUMmf-yang openclaw-cn apply_patch Tool sandbox-paths.ts assertNoSymlinkEscape link followingEPSS 0.3%CVE-2024-7237HIGHAVG AntiVirus Free AVGSvc Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2025-54798LOWtmp does not restrict arbitrary temporary file / directory write via symbolic link `dir` parameterEPSS 0.3%CVE-2023-27850—NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a file sharing mechanism that allows users with access to this feature to accessEPSS 0.3%CVE-2024-7243HIGHPanda Security Dome Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-47121MEDIUMSparkle: Binary delta apply intermediate-symlink traversal in malicious .deltaEPSS 0.3%CVE-2021-31997MEDIUMpython-postorius: postorius-permissions.sh used during %post allows local privilege escalation from postorius user to rootEPSS 0.3%CVE-2024-7241HIGHPanda Security Dome Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2024-7242HIGHPanda Security Dome Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2022-34292HIGHDocker Desktop for Windows before 4.6.0 allows attackers to overwrite any file through a symlink attack on the hyperv/create dockerBackendV2EPSS 0.3%CVE-2026-19909HIGHPAX Technology Q80 AIP File Parsing Link Following Remote Code Execution VulnerabilityEPSS 0.3%CVE-2025-21195MEDIUMAzure Service Fabric Runtime Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2022-31647HIGHDocker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 API via a symlink in tEPSS 0.3%CVE-2025-49738HIGHMicrosoft PC Manager Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-2490MEDIUMRustDesk Client for Windows Transfer File Link Following Information Disclosure VulnerabilityEPSS 0.3%CVE-2025-67124MEDIUMA TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arEPSS 0.3%CVE-2023-42099HIGHIntel Driver & Support Assistant Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2026-50511HIGHMicrosoft PC Manager Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2026-70427MEDIUMJenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction EPSS 0.3%CVE-2026-68491CRITICALAn insufficient check allowed for the overwrite of arbitrary files via a symlink.EPSS 0.3%