Falhas do tipo CWE-59

823 resultados

Seguimento de links simbólicos (symlink)

A aplicação segue links simbólicos sem validação, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Isso pode resultar em leitura, modificação ou exclusão de arquivos sensíveis fora do diretório esperado.

Exemplo

Um servidor web processa uploads em /tmp/uploads/, mas não verifica se os caminhos são links simbólicos. Um atacante cria um symlink em /tmp/uploads/config que aponta para /etc/passwd, e a aplicação sobrescreve o arquivo de senhas do sistema.

Como mitigar

Use funções que resolvem caminhos canônicos (realpath em C, Path.toRealPath() em Java) antes de qualquer operação com arquivo, e implemente verificações de TOCTOU (time-of-check-time-of-use). Mantenha operações sensíveis em diretórios controlados com permissões restritivas e evite processar symlinks vindos de áreas com controle de usuário.

CVE-2026-25187HIGHWinlogon Elevation of Privilege VulnerabilityEPSS 3.2%CVE-2020-0638HIGHAn elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an atEPSS 3.0%KEVCVE-2022-21919HIGHWindows User Profile Service Elevation of Privilege VulnerabilityEPSS 3.0%KEVCVE-2010-4226HIGHcpio, as used in build 2007.05.10, 2010.07.28, and possibly other versions, allows remote attackers to overwrite arbitrary files via a symliEPSS 2.9%CVE-2020-3437MEDIUMCisco SD-WAN vManage Software Information Disclosure VulnerabilityEPSS 2.9%CVE-2022-22995CRITICALWestern Digital My Cloud OS 5 and My Cloud Home Unauthenticated Arbitrary File Write Vulnerability in NetatalkEPSS 2.8%CVE-2018-10928HIGHA flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside EPSS 2.7%CVE-2024-35235MEDIUMCupsd Listen arbitrary chmod 0140777EPSS 2.4%CVE-2025-21391HIGHWindows Storage Elevation of Privilege VulnerabilityEPSS 2.3%KEVCVE-2019-1130HIGHAn elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows ElEPSS 2.3%KEVCVE-2026-42989HIGHWinlogon Elevation of Privilege VulnerabilityEPSS 2.3%CVE-2024-12905HIGHAn Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path TraEPSS 2.2%CVE-2023-4759HIGHImproper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file writeEPSS 2.2%CVE-2023-36723HIGHWindows Container Manager Service Elevation of Privilege VulnerabilityEPSS 2.2%CVE-2023-33148HIGHMicrosoft Office Elevation of Privilege VulnerabilityEPSS 2.1%CVE-2024-49107HIGHWmsRepair Service Elevation of Privilege VulnerabilityEPSS 1.9%CVE-2020-3223MEDIUMCisco IOS XE Software Web UI Arbitrary File Read VulnerabilityEPSS 1.9%CVE-2020-13095—Little Snitch version 4.5.1 and older changed ownership of a directory path controlled by the user. This allowed the user to escalate to rooEPSS 1.9%CVE-2021-37712HIGHArbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic linksEPSS 1.8%CVE-2023-29351HIGHWindows Group Policy Elevation of Privilege VulnerabilityEPSS 1.8%