Falhas do tipo CWE-59

823 resultados

Seguimento de links simbólicos (symlink)

A aplicação segue links simbólicos sem validação, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Isso pode resultar em leitura, modificação ou exclusão de arquivos sensíveis fora do diretório esperado.

Exemplo

Um servidor web processa uploads em /tmp/uploads/, mas não verifica se os caminhos são links simbólicos. Um atacante cria um symlink em /tmp/uploads/config que aponta para /etc/passwd, e a aplicação sobrescreve o arquivo de senhas do sistema.

Como mitigar

Use funções que resolvem caminhos canônicos (realpath em C, Path.toRealPath() em Java) antes de qualquer operação com arquivo, e implemente verificações de TOCTOU (time-of-check-time-of-use). Mantenha operações sensíveis em diretórios controlados com permissões restritivas e evite processar symlinks vindos de áreas com controle de usuário.

CVE-2026-14361MEDIUMConsul-template is vulnerable to path redirection in writeToFile through symlink attackEPSS 0.1%CVE-2026-53796MEDIUMrsync < 3.5.0 TOCTOU Race Condition via Destination Directory HandlingEPSS 0.1%CVE-2026-92253MEDIUMArbitrary File Write via Directory Junction in WatchDog Anti-Virus Quarantine RestorationEPSS 0.1%CVE-2026-7832HIGHIObit Advanced SystemCare Service ASC.exe symlinkEPSS 0.1%CVE-2026-76845MEDIUMadm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on ExtractionEPSS 0.1%CVE-2026-32020MEDIUMOpenClaw < 2026.2.22 - Arbitrary File Read via Symlink Following in Static File HandlerEPSS 0.1%CVE-2026-22180MEDIUMOpenClaw < 2026.3.2 - Path Confinement Bypass in Browser Output and File Write OperationsEPSS 0.1%CVE-2026-79699MEDIUMPodman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directoryEPSS 0.1%CVE-2026-16989HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2026-49135HIGHCodexBar < 0.32.0 Insecure Temporary File Handling in Notarization WorkflowEPSS 0.1%CVE-2026-20161MEDIUMCisco ThousandEyes Enterprise Agent Arbitrary File Overwrite VulnerabilityEPSS 0.1%CVE-2026-63426MEDIUMDuring an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated loEPSS 0.1%CVE-2026-17171HIGHVulnerabilities in IBM AIX and PowerVM VIOSEPSS 0.1%CVE-2026-8052MEDIUMNomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attackEPSS 0.1%CVE-2026-72694HIGHMrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulationEPSS 0.1%CVE-2026-22701MEDIUMfilelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLockEPSS 0.1%CVE-2025-24918MEDIUMImproper link resolution before file access ('link following') for some Intel(R) Server Configuration Utility software and Intel(R) Server FEPSS 0.1%CVE-2026-48693MEDIUMFastNetMon Community Edition through 1.2.9 is vulnerable to a local symlink attack via predictable file paths in /tmp. The statistics file pEPSS 0.1%CVE-2026-32054MEDIUMOpenClaw < 2026.2.25 - Symlink Traversal in Browser Trace/Download Path HandlingEPSS 0.1%CVE-2026-45384MEDIUMbit7z: Arbitrary File Overwrite via Symlink Attack on Predictable Temp File During Archive UpdateEPSS 0.1%