Falhas do tipo CWE-61

173 resultados

Seguimento de link simbólico Unix

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o alvo é seguro, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo pode achar que está lendo `/tmp/config.txt`, mas na verdade acessa `/etc/passwd` porque alguém criou um symlink malicioso apontando para lá.

Exemplo

Um script de backup cria arquivos em `/tmp` sem verificar se são symlinks. Um atacante cria um link simbólico `ln -s /etc/shadow /tmp/backup_old` e o script acaba sobrescrevendo o arquivo de senhas do sistema ao tentar fazer cleanup.

Como mitigar

Use flags de segurança ao abrir arquivos (`O_NOFOLLOW` em open(), `-h` em comandos Unix) para rejeitar symlinks, valide caminhos com `realpath()` antes de acessá-los, e configure permissões corretas em diretórios `/tmp` para evitar que usuários criem links simbólicos perigosos.

CVE-2024-52537MEDIUMDell Client Platform Firmware Update Utility contains an Improper Link Resolution vulnerability. A high privileged attacker with local accesEPSS 0.2%CVE-2026-14699MEDIUMzcaceres markdownify-mcp Markdownify.ts assertPathAllowed symlinkEPSS 0.2%CVE-2026-53489HIGHcontainerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restoreEPSS 0.2%CVE-2024-52542MEDIUMDell AppSync, version 4.6.0.x, contain a Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could EPSS 0.2%CVE-2026-56815HIGHpwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in the upload handler in Components/Pages/HomEPSS 0.2%CVE-2026-65010MEDIUMDatasets Symlink-following Arbitrary File Write via Extractor.extract()EPSS 0.2%CVE-2026-59674HIGHLPE from suricata user to root due to chown in %post in suricata packagingEPSS 0.2%CVE-2025-53881MEDIUMSUSE-specific logrotate configuration allows escalation from mail user/group to rootEPSS 0.2%CVE-2026-90616HIGHIn Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated EPSS 0.2%CVE-2025-46810HIGHA UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate EPSS 0.2%CVE-2026-22767HIGHDell AppSync, version(s) 4.6.0, contain(s) an UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local accEPSS 0.2%CVE-2026-77159MEDIUMLibvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlinkEPSS 0.2%CVE-2026-47766MEDIUMcrun follows rootfs /dev symlink while creating default devicesEPSS 0.2%CVE-2025-64750MEDIUMSingluarity ineffectively applies of selinux / apparmor LSM process labelsEPSS 0.2%CVE-2026-8784MEDIUMnpitre cramfs-tools cramfsck.c change_file_status symlinkEPSS 0.2%CVE-2025-1079HIGHRCE In Google Web DesignerEPSS 0.2%CVE-2023-39246MEDIUM Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server version prior to 11.8.1 contain an Insecure OEPSS 0.2%CVE-2025-43278MEDIUMThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protectEPSS 0.2%CVE-2026-54574HIGH`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar ArchiveEPSS 0.1%CVE-2026-13218MEDIUMKubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcherEPSS 0.1%