Falhas do tipo CWE-61

197 resultados

Seguimento de link simbólico Unix

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o alvo é seguro, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo pode achar que está lendo `/tmp/config.txt`, mas na verdade acessa `/etc/passwd` porque alguém criou um symlink malicioso apontando para lá.

Exemplo

Um script de backup cria arquivos em `/tmp` sem verificar se são symlinks. Um atacante cria um link simbólico `ln -s /etc/shadow /tmp/backup_old` e o script acaba sobrescrevendo o arquivo de senhas do sistema ao tentar fazer cleanup.

Como mitigar

Use flags de segurança ao abrir arquivos (`O_NOFOLLOW` em open(), `-h` em comandos Unix) para rejeitar symlinks, valide caminhos com `realpath()` antes de acessá-los, e configure permissões corretas em diretórios `/tmp` para evitar que usuários criem links simbólicos perigosos.

CVE-2026-33711MEDIUMIncus vulnerable to local privilege escalation through VM screenshot pathEPSS 0.4%CVE-2020-15076—Private Tunnel installer for macOS version 3.0.1 and older versions may corrupt system critical files it should not have access via symlinksEPSS 0.4%CVE-2026-41326HIGHKata Containers: CopyFile Policy Subversion via SymlinksEPSS 0.3%CVE-2026-42275HIGHzrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/writeEPSS 0.3%CVE-2026-7819HIGHpgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file writeEPSS 0.3%CVE-2025-30485MEDIUMUNIX symbolic link (Symlink) following issue exists in FutureNet NXR series, VXR series and WXR series routers. Attaching to the affected prEPSS 0.3%CVE-2026-43570MEDIUMOpenClaw 2026.3.22 < 2026.4.5 - Symlink Traversal in Remote Marketplace Repository Path HandlingEPSS 0.3%CVE-2021-32553HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2024-45310LOWrunc can be confused to create empty files/directories on the hostEPSS 0.3%CVE-2026-13201HIGHKubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruptionEPSS 0.3%CVE-2023-41969HIGHZSATrayManager Arbitrary File DeletionEPSS 0.3%CVE-2025-33225HIGHNVIDIA Resiliency Extension for Linux contains a vulnerability in log aggregation, where an attacker could cause predictable log-file names.EPSS 0.3%CVE-2020-15075—OpenVPN Connect installer for macOS version 3.2.6 and older may corrupt system critical files it should not have access via symlinks in /tmpEPSS 0.3%CVE-2021-32547HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2026-5223MEDIUMCrates in third party registries can override the cached source of other cratesEPSS 0.3%CVE-2025-43853HIGHiwasm vulnerable to filesystem sandbox escape with symlink when using uvwasi featureEPSS 0.3%CVE-2021-32548HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32551HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32550HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32555HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%