Falhas do tipo CWE-59

821 resultados

Seguimento de links simbólicos (symlink)

A aplicação segue links simbólicos sem validação, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Isso pode resultar em leitura, modificação ou exclusão de arquivos sensíveis fora do diretório esperado.

Exemplo

Um servidor web processa uploads em /tmp/uploads/, mas não verifica se os caminhos são links simbólicos. Um atacante cria um symlink em /tmp/uploads/config que aponta para /etc/passwd, e a aplicação sobrescreve o arquivo de senhas do sistema.

Como mitigar

Use funções que resolvem caminhos canônicos (realpath em C, Path.toRealPath() em Java) antes de qualquer operação com arquivo, e implemente verificações de TOCTOU (time-of-check-time-of-use). Mantenha operações sensíveis em diretórios controlados com permissões restritivas e evite processar symlinks vindos de áreas com controle de usuário.

CVE-2021-32552HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32551HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32554HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2025-24242MEDIUMThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4. An app with root privileges may be aEPSS 0.3%CVE-2026-48921HIGHJenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing aEPSS 0.3%CVE-2021-32555HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2023-0652HIGHLocal Privilege Escalation in Cloudflare WARP Installer (Windows)EPSS 0.3%CVE-2019-13689HIGHInappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remote attacker to perform arbitrary read/wrEPSS 0.3%CVE-2026-53476CRITICALAssisted-migration-agent: vddk tarball chained-symlink arbitrary file writeEPSS 0.3%CVE-2026-90807MEDIUMnanocoai NanoClaw Attachment agent-route.ts forwardAttachedFiles link followingEPSS 0.3%CVE-2024-45770MEDIUMPcp: pmpost symlink attack allows escalating pcp to root userEPSS 0.3%CVE-2022-21944HIGHwatchman: chown in watchman@.socket unit allows symlink attackEPSS 0.3%CVE-2026-53801HIGHrsync < 3.5.0 Symlink Race Condition Directory TraversalEPSS 0.3%CVE-2026-65680MEDIUMMicrosoft OneDrive for MacOS Elevation of Privilege VulnerabilityEPSS 0.3%CVE-2023-24577MEDIUMMcAfee Total Protection prior to 16.0.50 allows attackers to elevate user privileges due to Improper Link Resolution via registry keys. ThisEPSS 0.3%CVE-2026-40610MEDIUMBentoML has Information Disclosure in `bentoml build` via symlink traversal in the build contextEPSS 0.3%CVE-2025-24136MEDIUMThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS VenturaEPSS 0.3%CVE-2024-13043HIGHPanda Security Dome Link Following Local Privilege Escalation VulnerabilityEPSS 0.3%CVE-2025-24278MEDIUMThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS VenturaEPSS 0.3%CVE-2025-65843HIGHAquarius Desktop 3.0.069 for macOS contains an insecure file handling vulnerability in its support data archive generation feature. The applEPSS 0.3%