Falhas do tipo CWE-61

173 resultados

Seguimento de link simbólico Unix

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o alvo é seguro, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo pode achar que está lendo `/tmp/config.txt`, mas na verdade acessa `/etc/passwd` porque alguém criou um symlink malicioso apontando para lá.

Exemplo

Um script de backup cria arquivos em `/tmp` sem verificar se são symlinks. Um atacante cria um link simbólico `ln -s /etc/shadow /tmp/backup_old` e o script acaba sobrescrevendo o arquivo de senhas do sistema ao tentar fazer cleanup.

Como mitigar

Use flags de segurança ao abrir arquivos (`O_NOFOLLOW` em open(), `-h` em comandos Unix) para rejeitar symlinks, valide caminhos com `realpath()` antes de acessá-los, e configure permissões corretas em diretórios `/tmp` para evitar que usuários criem links simbólicos perigosos.

CVE-2024-47877MEDIUMExtract has insufficient checks allowing attacker to create symlinks outside the extraction directory.EPSS 0.5%CVE-2026-24047MEDIUM@backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain BypassEPSS 0.5%CVE-2026-55168MEDIUMRuntipi: Authenticated arbitrary file write via backup restore symlink plantingEPSS 0.5%CVE-2020-8019HIGHsyslog-ng: Local privilege escalation from new to root in %postEPSS 0.5%CVE-2026-63125CRITICALIncus vulnerable to root RCE via image backup.yaml symlinkEPSS 0.5%CVE-2025-68937CRITICALForgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-EPSS 0.5%CVE-2020-8014HIGHkopano-python-services: Local privilege escalation from kopano to root in kopano-spamd subpackageEPSS 0.5%CVE-2026-29203MEDIUMA chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system filEPSS 0.5%CVE-2026-27976HIGHZed Extension Sandbox Escape via Tar Symlink FollowingEPSS 0.5%CVE-2024-45418MEDIUMZoom Apps for macOS - Symbolic Link FollowingEPSS 0.5%CVE-2026-52811CRITICALGogs: UploadRepoFiles writes outside repo working tree via committed parent symEPSS 0.5%CVE-2025-24886HIGHpwn.college has Symlink LFI in Dojo reposEPSS 0.5%CVE-2025-10854HIGHSymlink Following in txtai leads to arbitrary file write when loading untrusted embedding indicesEPSS 0.5%CVE-2025-59829LOWClaude Code: Permission deny bypass is possible through symlinkEPSS 0.4%CVE-2021-25321HIGHarpwatch: Local privilege escalation from runtime user to rootEPSS 0.4%CVE-2021-25322MEDIUMpython-HyperKitty: hyperkitty-permissions.sh used during %post allows local privilege escalation from hyperkitty user to rootEPSS 0.4%CVE-2025-67487MEDIUMStatic Web Server is vulnerable to symbolic link Path TraversalEPSS 0.4%CVE-2026-25724LOWClaude Code Has Permission Deny Bypass Through Symbolic LinksEPSS 0.4%CVE-2026-41937HIGHVvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin UploadEPSS 0.4%CVE-2026-35525HIGHLiquidJS has a root restriction bypass for partial and layout loading through symlinked templatesEPSS 0.4%