Falhas do tipo CWE-61

197 resultados

Seguimento de link simbólico Unix

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o alvo é seguro, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo pode achar que está lendo `/tmp/config.txt`, mas na verdade acessa `/etc/passwd` porque alguém criou um symlink malicioso apontando para lá.

Exemplo

Um script de backup cria arquivos em `/tmp` sem verificar se são symlinks. Um atacante cria um link simbólico `ln -s /etc/shadow /tmp/backup_old` e o script acaba sobrescrevendo o arquivo de senhas do sistema ao tentar fazer cleanup.

Como mitigar

Use flags de segurança ao abrir arquivos (`O_NOFOLLOW` em open(), `-h` em comandos Unix) para rejeitar symlinks, valide caminhos com `realpath()` antes de acessá-los, e configure permissões corretas em diretórios `/tmp` para evitar que usuários criem links simbólicos perigosos.

CVE-2025-10854HIGHSymlink Following in txtai leads to arbitrary file write when loading untrusted embedding indicesEPSS 0.5%CVE-2025-59829LOWClaude Code: Permission deny bypass is possible through symlinkEPSS 0.4%CVE-2026-107810HIGHNginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are appliedEPSS 0.4%CVE-2021-25321HIGHarpwatch: Local privilege escalation from runtime user to rootEPSS 0.4%CVE-2021-25322MEDIUMpython-HyperKitty: hyperkitty-permissions.sh used during %post allows local privilege escalation from hyperkitty user to rootEPSS 0.4%CVE-2026-115908HIGHzip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0)EPSS 0.4%CVE-2026-35632MEDIUMOpenClaw < 2026.3.24 - Symlink Traversal via IDENTITY.md appendFile in agents.create/updateEPSS 0.4%CVE-2025-67487MEDIUMStatic Web Server is vulnerable to symbolic link Path TraversalEPSS 0.4%CVE-2026-6475HIGHPostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choiceEPSS 0.4%CVE-2026-35525HIGHLiquidJS has a root restriction bypass for partial and layout loading through symlinked templatesEPSS 0.4%CVE-2026-55686MEDIUMPodman: WORKDIR symlink traversal vulnerabilityEPSS 0.4%CVE-2025-5468MEDIUMImproper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, IvantiEPSS 0.4%CVE-2026-41937HIGHVvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin UploadEPSS 0.4%CVE-2025-57802HIGHAirlink's Daemon Symlink VulnerabilityEPSS 0.4%CVE-2026-33056MEDIUMtar-rs: unpack_in can chmod arbitrary directories by following symlinksEPSS 0.4%CVE-2024-0134MEDIUMNVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead tEPSS 0.4%CVE-2021-32557MEDIUMapport process_report() arbitrary file writeEPSS 0.4%CVE-2026-106507MEDIUMBackstage: TechDocs arbitrary file read via mkdocs snippetsEPSS 0.4%CVE-2026-41541MEDIUMSymlink creation in qsyncsrv.cgiEPSS 0.4%CVE-2026-50612CRITICALImport Symlink Following Remote Code Execution Vulnerability in QuMagieEPSS 0.4%