Falhas do tipo CWE-61

173 resultados

Seguimento de link simbólico Unix

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o alvo é seguro, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo pode achar que está lendo `/tmp/config.txt`, mas na verdade acessa `/etc/passwd` porque alguém criou um symlink malicioso apontando para lá.

Exemplo

Um script de backup cria arquivos em `/tmp` sem verificar se são symlinks. Um atacante cria um link simbólico `ln -s /etc/shadow /tmp/backup_old` e o script acaba sobrescrevendo o arquivo de senhas do sistema ao tentar fazer cleanup.

Como mitigar

Use flags de segurança ao abrir arquivos (`O_NOFOLLOW` em open(), `-h` em comandos Unix) para rejeitar symlinks, valide caminhos com `realpath()` antes de acessá-los, e configure permissões corretas em diretórios `/tmp` para evitar que usuários criem links simbólicos perigosos.

CVE-2025-62724MEDIUMOpen OnDemand allowlist bypass using symlinks in directory downloads (TOCTOU)EPSS 0.2%CVE-2024-34015LOWSensitive information disclosure during file browsing due to improper symbolic link handling. The following products are affected: Acronis BEPSS 0.2%CVE-2024-34014MEDIUMArbitrary file overwrite during recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin EPSS 0.2%CVE-2026-20694MEDIUMThis issue was addressed with improved handling of symlinks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS SeEPSS 0.2%CVE-2025-24832MEDIUMArbitrary file overwrite during home directory recovery due to improper symbolic link handling. The following products are affected: AcronisEPSS 0.2%CVE-2023-20091MEDIUMCisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Overwrite VulnerabilityEPSS 0.2%CVE-2023-20092MEDIUMCisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Overwrite VulnerabilityEPSS 0.2%CVE-2023-20093MEDIUMCisco TelePresence Collaboration Endpoint and RoomOS Software Arbitrary File Overwrite VulnerabilityEPSS 0.2%CVE-2024-47480HIGHDell Inventory Collector Client, versions prior to 12.7.0, contains an Improper Link Resolution Before File Access vulnerability. A low-privEPSS 0.2%CVE-2026-39860CRITICALNix sandbox escape: file write via symlink at FOD `.tmp` copy destinationEPSS 0.2%CVE-2024-39578MEDIUMDell PowerScale OneFS versions 8.2.2.x through 9.8.0.1 contains a UNIX symbolic link (symlink) following vulnerability. A local high privileEPSS 0.2%CVE-2026-12958HIGHArbitrary file write in Language Servers for AWSEPSS 0.2%CVE-2024-25953MEDIUMDell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privilEPSS 0.2%CVE-2024-25952MEDIUMDell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privilEPSS 0.2%CVE-2026-41579LOWrunc: Malicious image with /dev symlink can trigger limited host filesystem integrity violationsEPSS 0.2%CVE-2026-13748MEDIUMSnowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path RestrictionEPSS 0.2%CVE-2026-12080HIGHQemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keysEPSS 0.2%CVE-2025-22480HIGHDell SupportAssist OS Recovery versions prior to 5.5.13.1 contain a symbolic link attack vulnerability. A low-privileged attacker with localEPSS 0.2%CVE-2026-34446MEDIUMONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX loadEPSS 0.2%CVE-2025-54867HIGHYouki Symlink Following VulnerabilityEPSS 0.2%