Falhas do tipo CWE-61

197 resultados

Seguimento de link simbólico Unix

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o alvo é seguro, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo pode achar que está lendo `/tmp/config.txt`, mas na verdade acessa `/etc/passwd` porque alguém criou um symlink malicioso apontando para lá.

Exemplo

Um script de backup cria arquivos em `/tmp` sem verificar se são symlinks. Um atacante cria um link simbólico `ln -s /etc/shadow /tmp/backup_old` e o script acaba sobrescrevendo o arquivo de senhas do sistema ao tentar fazer cleanup.

Como mitigar

Use flags de segurança ao abrir arquivos (`O_NOFOLLOW` em open(), `-h` em comandos Unix) para rejeitar symlinks, valide caminhos com `realpath()` antes de acessá-los, e configure permissões corretas em diretórios `/tmp` para evitar que usuários criem links simbólicos perigosos.

CVE-2026-31893MEDIUMTunnelblick arbitrary file read via symlink following in tunnelblickdEPSS 0.2%CVE-2026-118688HIGHWasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink RenameEPSS 0.2%CVE-2024-52522MEDIUMRclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadataEPSS 0.2%CVE-2026-23968MEDIUMCopier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: falseEPSS 0.2%CVE-2026-53802HIGHrsync < 3.5.0 Arbitrary File Read via Symlink FollowingEPSS 0.2%CVE-2024-44132HIGHThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15. An app may be able to break out of itsEPSS 0.2%CVE-2026-39822HIGHRoot escape via symlink plus trailing slash in osEPSS 0.2%CVE-2025-62724MEDIUMOpen OnDemand allowlist bypass using symlinks in directory downloads (TOCTOU)EPSS 0.2%CVE-2025-14693HIGHUgreen DH2100+ USB symlinkEPSS 0.2%CVE-2025-59825MEDIUMastral-tokio-tar has a path traversal in tar extractionEPSS 0.2%CVE-2026-54574HIGH`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar ArchiveEPSS 0.2%CVE-2026-1386MEDIUMArbitrary Host File Overwrite via Symlink in Firecracker JailerEPSS 0.2%CVE-2024-1933HIGHImproper symlink resolution in TeamViewer Remote client for macOSEPSS 0.2%CVE-2026-20694MEDIUMThis issue was addressed with improved handling of symlinks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS SeEPSS 0.2%CVE-2024-34015LOWSensitive information disclosure during file browsing due to improper symbolic link handling. The following products are affected: Acronis BEPSS 0.2%CVE-2026-39860CRITICALNix sandbox escape: file write via symlink at FOD `.tmp` copy destinationEPSS 0.2%CVE-2024-34014MEDIUMArbitrary file overwrite during recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin EPSS 0.2%CVE-2026-47763MEDIUMpdm: Project-Local State and Config Writes Follow SymlinksEPSS 0.2%CVE-2026-47766MEDIUMcrun follows rootfs /dev symlink while creating default devicesEPSS 0.2%CVE-2025-24832MEDIUMArbitrary file overwrite during home directory recovery due to improper symbolic link handling. The following products are affected: AcronisEPSS 0.2%