Falhas do tipo CWE-59

823 resultados

Seguimento de links simbólicos (symlink)

A aplicação segue links simbólicos sem validação, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Isso pode resultar em leitura, modificação ou exclusão de arquivos sensíveis fora do diretório esperado.

Exemplo

Um servidor web processa uploads em /tmp/uploads/, mas não verifica se os caminhos são links simbólicos. Um atacante cria um symlink em /tmp/uploads/config que aponta para /etc/passwd, e a aplicação sobrescreve o arquivo de senhas do sistema.

Como mitigar

Use funções que resolvem caminhos canônicos (realpath em C, Path.toRealPath() em Java) antes de qualquer operação com arquivo, e implemente verificações de TOCTOU (time-of-check-time-of-use). Mantenha operações sensíveis em diretórios controlados com permissões restritivas e evite processar symlinks vindos de áreas com controle de usuário.

CVE-2025-43461MEDIUMThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS Tahoe 26.1. An app may be able to access protectEPSS 0.2%CVE-2026-6941MEDIUMradare2 < 6.1.4 Project Notes Path Traversal via SymlinkEPSS 0.2%CVE-2025-68146MEDIUMfilelock has TOCTOU race condition that allows symlink attacks during lock file creationEPSS 0.2%CVE-2025-20003HIGHImproper link resolution before file access ('Link Following') for some Intel(R) Graphics Driver software installers may allow an authenticaEPSS 0.2%CVE-2025-9968HIGHA link following vulnerability exists in the UnifyScanner component of Armoury Crate. This vulnerability may be triggered by creating a specEPSS 0.2%CVE-2025-15543MEDIUMRead-Only Root Access via USB Storage Device in TP-Link VX800vEPSS 0.2%CVE-2026-31979HIGHhimmelblaud-tasks: local privilege escalation via /tmp symlink attack on Kerberos ccacheEPSS 0.2%CVE-2025-43381MEDIUMThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26.1. A malicious app may be able to delete EPSS 0.2%CVE-2026-82331CRITICALApache BuildStream: tar source extraction escapeEPSS 0.2%CVE-2021-23892HIGHBy exploiting a time of check to time of use (TOCTOU) race condition during the Endpoint Security for Linux Threat Prevention and Firewall (EPSS 0.2%CVE-2024-11857HIGHRealtek Bluetooth HCI Adaptor - Privilege EscalationEPSS 0.2%CVE-2026-41433HIGHOpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIREPSS 0.2%CVE-2026-15684HIGHGlarysoft Glary Utilities Link Following Local Privilege Escalation VulnerabilityEPSS 0.2%CVE-2023-20004MEDIUMCisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Write VulnerabilityEPSS 0.2%CVE-2023-20008MEDIUMA vulnerability in the CLI of Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to overwrite arbitrary EPSS 0.2%CVE-2026-62239MEDIUMFlashAttention Symlink Attack via tarfile.extractall in hopper/setup.pyEPSS 0.2%CVE-2026-45403LOWAnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directoryEPSS 0.2%CVE-2026-53785MEDIUMrsync < 3.5.0 Path Traversal Write Escape via --relative ModeEPSS 0.2%CVE-2025-34352HIGHJumpCloud Remote Assist < 0.317.0 Arbitrary File Write/Delete via Insecure Temp DirectoryEPSS 0.2%CVE-2025-30641HIGHA link following vulnerability in the anti-malware solution portion of Trend Micro Deep Security 20.0 agents could allow a local attacker toEPSS 0.2%