Falhas do tipo CWE-61

173 resultados

Seguimento de link simbólico Unix

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o alvo é seguro, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo pode achar que está lendo `/tmp/config.txt`, mas na verdade acessa `/etc/passwd` porque alguém criou um symlink malicioso apontando para lá.

Exemplo

Um script de backup cria arquivos em `/tmp` sem verificar se são symlinks. Um atacante cria um link simbólico `ln -s /etc/shadow /tmp/backup_old` e o script acaba sobrescrevendo o arquivo de senhas do sistema ao tentar fazer cleanup.

Como mitigar

Use flags de segurança ao abrir arquivos (`O_NOFOLLOW` em open(), `-h` em comandos Unix) para rejeitar symlinks, valide caminhos com `realpath()` antes de acessá-los, e configure permissões corretas em diretórios `/tmp` para evitar que usuários criem links simbólicos perigosos.

CVE-2025-57802HIGHAirlink's Daemon Symlink VulnerabilityEPSS 0.4%CVE-2026-56876HIGHextract-zip unvalidated symlink path traversalEPSS 0.4%CVE-2021-32557MEDIUMapport process_report() arbitrary file writeEPSS 0.4%CVE-2026-33056MEDIUMtar-rs: unpack_in can chmod arbitrary directories by following symlinksEPSS 0.4%CVE-2026-55686MEDIUMPodman: WORKDIR symlink traversal vulnerabilityEPSS 0.4%CVE-2024-0134MEDIUMNVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead tEPSS 0.4%CVE-2026-62992MEDIUMSmarty: Symlink path traversal out of trusted directoriesEPSS 0.4%CVE-2025-5468MEDIUMImproper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, IvantiEPSS 0.4%CVE-2026-7819HIGHpgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file writeEPSS 0.4%CVE-2020-15076—Private Tunnel installer for macOS version 3.0.1 and older versions may corrupt system critical files it should not have access via symlinksEPSS 0.4%CVE-2026-33711MEDIUMIncus vulnerable to local privilege escalation through VM screenshot pathEPSS 0.4%CVE-2026-41326HIGHKata Containers: CopyFile Policy Subversion via SymlinksEPSS 0.3%CVE-2026-91099MEDIUMHP Linux Imaging and Printing (HPLIP) Software– Multiple VulnerabilitiesEPSS 0.3%CVE-2026-42275HIGHzrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/writeEPSS 0.3%CVE-2026-35632MEDIUMOpenClaw <= 2026.2.22 - Symlink Traversal via IDENTITY.md appendFile in agents.create/updateEPSS 0.3%CVE-2026-6475HIGHPostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choiceEPSS 0.3%CVE-2026-43570MEDIUMOpenClaw 2026.3.22 < 2026.4.5 - Symlink Traversal in Remote Marketplace Repository Path HandlingEPSS 0.3%CVE-2021-32553HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2026-17459MEDIUMperwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlinkEPSS 0.3%CVE-2025-30485MEDIUMUNIX symbolic link (Symlink) following issue exists in FutureNet NXR series, VXR series and WXR series routers. Attaching to the affected prEPSS 0.3%