Falhas do tipo CWE-61

173 resultados

Seguimento de link simbólico Unix

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o alvo é seguro, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo pode achar que está lendo `/tmp/config.txt`, mas na verdade acessa `/etc/passwd` porque alguém criou um symlink malicioso apontando para lá.

Exemplo

Um script de backup cria arquivos em `/tmp` sem verificar se são symlinks. Um atacante cria um link simbólico `ln -s /etc/shadow /tmp/backup_old` e o script acaba sobrescrevendo o arquivo de senhas do sistema ao tentar fazer cleanup.

Como mitigar

Use flags de segurança ao abrir arquivos (`O_NOFOLLOW` em open(), `-h` em comandos Unix) para rejeitar symlinks, valide caminhos com `realpath()` antes de acessá-los, e configure permissões corretas em diretórios `/tmp` para evitar que usuários criem links simbólicos perigosos.

CVE-2025-62596HIGHyouki container escape and denial of service due to arbitrary write gadgets and procfs write redirectsEPSS 0.2%CVE-2026-34447MEDIUMONNX: External Data Symlink TraversalEPSS 0.2%CVE-2025-11489LOWwonderwhy-er DesktopCommanderMCP filesystem.ts isPathAllowed symlinkEPSS 0.2%CVE-2024-23285HIGHThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sonoma 14.4. An app may be able to create symlinksEPSS 0.2%CVE-2025-62161HIGHyouki container escape via "masked path" abuse due to mount race conditionsEPSS 0.2%CVE-2026-31893MEDIUMTunnelblick arbitrary file read via symlink following in tunnelblickdEPSS 0.2%CVE-2026-53802HIGHrsync < 3.5.0 Arbitrary File Read via Symlink FollowingEPSS 0.2%CVE-2024-44132HIGHThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15. An app may be able to break out of itsEPSS 0.2%CVE-2026-23968MEDIUMCopier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: falseEPSS 0.2%CVE-2025-65105MEDIUMApptainer ineffective application of selinux and apparmor --security optionsEPSS 0.2%CVE-2026-39822HIGHRoot escape via symlink plus trailing slash in osEPSS 0.2%CVE-2026-27485MEDIUMOpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injectionEPSS 0.2%CVE-2026-24018HIGHA UNIX symbolic link (Symlink) following vulnerability in Fortinet FortiClientLinux 7.4.0 through 7.4.4, FortiClientLinux 7.2.2 through 7.2.EPSS 0.2%CVE-2026-13201HIGHKubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruptionEPSS 0.2%CVE-2025-14693HIGHUgreen DH2100+ USB symlinkEPSS 0.2%CVE-2026-47763MEDIUMpdm: Project-Local State and Config Writes Follow SymlinksEPSS 0.2%CVE-2026-1386MEDIUMArbitrary Host File Overwrite via Symlink in Firecracker JailerEPSS 0.2%CVE-2025-59825MEDIUMastral-tokio-tar has a path traversal in tar extractionEPSS 0.2%CVE-2024-52522MEDIUMRclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadataEPSS 0.2%CVE-2024-1933HIGHImproper symlink resolution in TeamViewer Remote client for macOSEPSS 0.2%