Falhas do tipo CWE-61

197 resultados

Seguimento de link simbólico Unix

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o alvo é seguro, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo pode achar que está lendo `/tmp/config.txt`, mas na verdade acessa `/etc/passwd` porque alguém criou um symlink malicioso apontando para lá.

Exemplo

Um script de backup cria arquivos em `/tmp` sem verificar se são symlinks. Um atacante cria um link simbólico `ln -s /etc/shadow /tmp/backup_old` e o script acaba sobrescrevendo o arquivo de senhas do sistema ao tentar fazer cleanup.

Como mitigar

Use flags de segurança ao abrir arquivos (`O_NOFOLLOW` em open(), `-h` em comandos Unix) para rejeitar symlinks, valide caminhos com `realpath()` antes de acessá-los, e configure permissões corretas em diretórios `/tmp` para evitar que usuários criem links simbólicos perigosos.

CVE-2021-32555HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32548HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2021-32550HIGHapport read_file() function could follow maliciously constructed symbolic linksEPSS 0.3%CVE-2026-107174MEDIUMSource-to-image: source-to-image: security boundary bypass via absolute symbolic link extractionEPSS 0.3%CVE-2026-23986MEDIUMCopier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: trueEPSS 0.3%CVE-2025-66431HIGHWebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root viaEPSS 0.3%CVE-2025-62596HIGHyouki container escape and denial of service due to arbitrary write gadgets and procfs write redirectsEPSS 0.3%CVE-2026-24018HIGHA UNIX symbolic link (Symlink) following vulnerability in Fortinet FortiClientLinux 7.4.0 through 7.4.4, FortiClientLinux 7.2.2 through 7.2.EPSS 0.3%CVE-2025-62161HIGHyouki container escape via "masked path" abuse due to mount race conditionsEPSS 0.3%CVE-2026-34447MEDIUMONNX: External Data Symlink TraversalEPSS 0.3%CVE-2025-11489LOWwonderwhy-er DesktopCommanderMCP filesystem.ts isPathAllowed symlinkEPSS 0.3%CVE-2026-28684MEDIUMpython-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallbackEPSS 0.3%CVE-2026-103435HIGHArbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude CodeEPSS 0.3%CVE-2024-27872MEDIUMThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sonoma 14.6. An app may be able to access protecEPSS 0.3%CVE-2021-1612MEDIUMCisco IOS XE SD-WAN Software Arbitrary File Overwrite VulnerabilityEPSS 0.3%CVE-2026-27485MEDIUMOpenClaw affected by Stored XSS in Control UI via unsanitized assistant name/avatar in inline script injectionEPSS 0.2%CVE-2025-65105MEDIUMApptainer ineffective application of selinux and apparmor --security optionsEPSS 0.2%CVE-2026-119336HIGHPi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlinkEPSS 0.2%CVE-2024-23285HIGHThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sonoma 14.4. An app may be able to create symlinksEPSS 0.2%CVE-2026-115392HIGHWasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing SlashesEPSS 0.2%