Falhas do tipo CWE-61

195 resultados

Seguimento de link simbólico Unix

Ocorre quando uma aplicação segue um link simbólico (symlink) sem validar se o alvo é seguro, permitindo que um atacante redirecione operações de arquivo para locais não autorizados. Um processo pode achar que está lendo `/tmp/config.txt`, mas na verdade acessa `/etc/passwd` porque alguém criou um symlink malicioso apontando para lá.

Exemplo

Um script de backup cria arquivos em `/tmp` sem verificar se são symlinks. Um atacante cria um link simbólico `ln -s /etc/shadow /tmp/backup_old` e o script acaba sobrescrevendo o arquivo de senhas do sistema ao tentar fazer cleanup.

Como mitigar

Use flags de segurança ao abrir arquivos (`O_NOFOLLOW` em open(), `-h` em comandos Unix) para rejeitar symlinks, valide caminhos com `realpath()` antes de acessá-los, e configure permissões corretas em diretórios `/tmp` para evitar que usuários criem links simbólicos perigosos.

CVE-2025-64750MEDIUMSingluarity ineffectively applies of selinux / apparmor LSM process labelsEPSS 0.2%CVE-2026-79939MEDIUMDell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged EPSS 0.2%CVE-2026-32657HIGHDell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1, Dell VxRail Version 8.0.322, Dell PowerMax VersionEPSS 0.2%CVE-2026-59674HIGHLPE from suricata user to root due to chown in %post in suricata packagingEPSS 0.2%CVE-2025-53881MEDIUMSUSE-specific logrotate configuration allows escalation from mail user/group to rootEPSS 0.2%CVE-2026-22767HIGHDell AppSync, version(s) 4.6.0, contain(s) an UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local accEPSS 0.2%CVE-2025-46810HIGHA UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate EPSS 0.2%CVE-2026-108981LOWngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., EPSS 0.2%CVE-2026-115424MEDIUMOc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destinationEPSS 0.2%CVE-2026-75038MEDIUMPredictable temporary file in /tmp allows symlink attack in LACTEPSS 0.2%CVE-2026-77159MEDIUMLibvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlinkEPSS 0.2%CVE-2025-1079HIGHRCE In Google Web DesignerEPSS 0.2%CVE-2026-8784MEDIUMnpitre cramfs-tools cramfsck.c change_file_status symlinkEPSS 0.2%CVE-2023-39246MEDIUM Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server version prior to 11.8.1 contain an Insecure OEPSS 0.2%CVE-2025-43278MEDIUMThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protectEPSS 0.2%CVE-2026-13218MEDIUMKubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcherEPSS 0.1%CVE-2026-12080HIGHQemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keysEPSS 0.1%CVE-2026-7397MEDIUMNousResearch hermes-agent file_tools.py _check_sensitive_path symlinkEPSS 0.1%CVE-2026-35372MEDIUMuutils coreutils ln Security Bypass via Improper Handling of the --no-dereference FlagEPSS 0.1%CVE-2026-106566MEDIUMImageMagick: Policy Bypass in delegate symlink cleanup due to missing checkEPSS 0.1%