Weakness (CWE)
CWE-59: Improper Link Resolution Before File Access
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
How to prevent it (1 mitigation)
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Source: MITRE CWE-59
594 results · Clear filters · Feed
-
High 7.2CVE-2026-104068 Public exploit
JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore
JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup …
-
High 7.0
Cisco Expressway Series Software Hardening Release: October 2026 - Improper Link Resolution Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address mul…
-
High 7.8
Dulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks
Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped sta…
-
High 7.8
Dulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter
Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where a…
-
High 7.8
Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository where a worktree symlink …
-
High 7.1
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side files by name; on POSIX systems an attacker with rename access in a non-sticky parent can swap those names to cause overwri…
-
High 7.5
CLI Bridge: High-severity sandbox escape via dangling symlink
CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent d…
-
High 8.7
Path Traversal in Virtualization Station VM Import
An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We…
-
High 7.5
Gitingest through 0.3.1 Arbitrary File Read via Symlink in Blob Ingestion
Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs. Attackers can commit a symlink to a public repository and…
-
High 8.1
Ludwig: Path traversal in dataset archive extraction allows arbitrary file write via symlink members
Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extract_archive() validated tar member names before calling TarFile.extractall() but did not validate symlink members or h…
-
High 7.8
Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush
A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two d…
-
High 7.0
Windows Backup Engine Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Subsystem for Linux Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerability
Improper access control in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Windows Search Component Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
-
High 7.8
.NET Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
-
High 7.8
.NET Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows WalletService Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Windows Search Component Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Portable Device Enumerator Service Elevation of Privilege Vulnerability
Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Host Guardian Service Elevation of Privilege Vulnerability
Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows User Profile Service Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.
-
High 7.3
.NET Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows AppX Deployment Service Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Hyper-V Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Registry Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows Registry allows an authorized attacker to elevate privileges locally.
-
High 7.0
Windows Update Orchestrator Service Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Windows Search Component Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Update Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker to elevate privileges locally.
-
High 8.5
Local Privilege Escalation
Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS. This issue affects UniconOS: before 2607 CR and before 2603 LTSR CU2.
-
High 7.1
Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root
Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.is_path_in_project() normalizes paths lexically without resolving symlink…
-
High 8.1
Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and restore_nginx_ui flags and permits symlinks targeting the live Nginx configuration path…
-
High 8.8
Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution
A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), an…
-
High 7.3
Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can in…
-
High 7.8
Intego Antivirus through 3.0.0.1 Local Privilege Escalation via Optimization Module Junction
Intego Antivirus for Windows through 3.0.0.1 contains a link following vulnerability in its optimization module that allows local unprivileged users to delete arbitrary folders as SYSTEM. Attackers can replace a scanned duplicate file's directory with a junct…
-
High 8.5
Backstage: Improper task state validation in Scaffolder backend
Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper task state validation in scaffolder backend. An authenticated user with permission …
-
High 8.5
Backstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions
Backstage is an open framework for building developer portals. Prior to 0.3.10 in @backstage/plugin-scaffolder-backend-module-bitbucket-cloud and 0.2.25 in @backstage/plugin-scaffolder-backend-module-bitbucket-server, the Bitbucket pull-request Scaffolder act…
-
High 7.8
Kiteworks Core Local Privilege Escalation
A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend service account on the appliance to escalate to root. A privileged routine did not safely handle a filesystem path tha…
-
High 7.8
Kiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation
A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service account to escalate to root privileges on the appliance.
-
High 8.5
Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalation
Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.