Falhas do tipo CWE-61

197 resultados

Seguimento de link simbólico Unix

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o alvo é seguro, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo pode achar que está lendo `/tmp/config.txt`, mas na verdade acessa `/etc/passwd` porque alguém criou um symlink malicioso apontando para lá.

Exemplo

Um script de backup cria arquivos em `/tmp` sem verificar se são symlinks. Um atacante cria um link simbólico `ln -s /etc/shadow /tmp/backup_old` e o script acaba sobrescrevendo o arquivo de senhas do sistema ao tentar fazer cleanup.

Como mitigar

Use flags de segurança ao abrir arquivos (`O_NOFOLLOW` em open(), `-h` em comandos Unix) para rejeitar symlinks, valide caminhos com `realpath()` antes de acessá-los, e configure permissões corretas em diretórios `/tmp` para evitar que usuários criem links simbólicos perigosos.

CVE-2026-49248HIGHOneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untarEPSS 0.6%CVE-2021-39135HIGHUNIX Symbolic Link (Symlink) Following in @npmcli/arboristEPSS 0.6%CVE-2024-47515HIGHPagure: generate_archive() follows symbolic links in temporary clonesEPSS 0.6%CVE-2024-52535HIGHDell SupportAssist for Home PCs versions 4.6.1 and prior and Dell SupportAssist for Business PCs versions 4.5.0 and prior, contain a symboliEPSS 0.6%CVE-2024-47877MEDIUMExtract has insufficient checks allowing attacker to create symlinks outside the extraction directory.EPSS 0.5%CVE-2026-24047MEDIUM@backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain BypassEPSS 0.5%CVE-2026-62992MEDIUMSmarty: Symlink path traversal out of trusted directoriesEPSS 0.5%CVE-2026-56876HIGHextract-zip unvalidated symlink path traversalEPSS 0.5%CVE-2020-8019HIGHsyslog-ng: Local privilege escalation from new to root in %postEPSS 0.5%CVE-2025-68937CRITICALForgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-EPSS 0.5%CVE-2020-8014HIGHkopano-python-services: Local privilege escalation from kopano to root in kopano-spamd subpackageEPSS 0.5%CVE-2026-29203MEDIUMA chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system filEPSS 0.5%CVE-2025-24886HIGHpwn.college has Symlink LFI in Dojo reposEPSS 0.5%CVE-2024-45418MEDIUMZoom Apps for macOS - Symbolic Link FollowingEPSS 0.5%CVE-2026-25724LOWClaude Code Has Permission Deny Bypass Through Symbolic LinksEPSS 0.5%CVE-2026-52811CRITICALGogs: UploadRepoFiles writes outside repo working tree via committed parent symEPSS 0.5%CVE-2026-57825MEDIUMIn the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .EPSS 0.5%CVE-2026-97024HIGHFlatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etcEPSS 0.5%CVE-2026-17459MEDIUMperwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlinkEPSS 0.5%CVE-2026-97023HIGHFlatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/binEPSS 0.5%