Weakness (CWE)
CWE-59: Improper Link Resolution Before File Access
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
How to prevent it (1 mitigation)
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Source: MITRE CWE-59
1,132 results · Feed
-
High 7.7
Local privilege escalation from user news to root in the packaging of inn
The packaging of inn on SUSE Linux Enterprise Server 11; openSUSE Factory, Leap 15.1 allows local attackers to escalate from user inn to root via symlink attacks. This issue affects: SUSE Linux Enterprise Server 11 inn version 2.4.2-170.21.3.1 and prior versi…
-
High 7.7
Local privilege escalation from user munge to root
A Symbolic Link (Symlink) Following vulnerability in the packaging of munge in SUSE Linux Enterprise Server 15; openSUSE Factory allowed local attackers to escalate privileges from user munge to root. This issue affects: SUSE Linux Enterprise Server 15 munge …
-
High 7.7
trousers: Local privilege escalation from tss to root
UNIX Symbolic Link (Symlink) Following vulnerability in the trousers package of SUSE Linux Enterprise Server 15 SP1; openSUSE Factory allowed local attackers escalate privileges from user tss to root. This issue affects: SUSE Linux Enterprise Server 15 SP1 tr…
-
High 7.8CVE-2020-0638 Exploited · Ransomware
An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this…
KEV May 23, 2022 -
Unscored —
A denial of service vulnerability was reported in Check Point Endpoint Security Client for Windows before E82.10, that …
-
High 7.7
Unauthorized File Access in npm CLI before before version 6.13.3
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.j…
-
Unscored —
SafeNet Sentinel LDK License Manager, all versions prior to 7.101(only Microsoft Windows versions are affected) is vuln…
-
Medium 6.8
chkstat follows untrusted symbolic links
The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that is traversed by chkst…
-
Medium 5.5
Link Following in rply
python-rply before 0.7.4 insecurely creates temporary files.
-
High 7.8CVE-2019-1385 Exploited · Ransomware
An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privileg…
KEV May 23, 2022 -
Critical 9.8
Helm Unsafe Link Following
In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service (DoS) via a spec…
-
High 7.5
Hadoop symlink vulnerability
Hadoop 1.0.3 contains a symlink vulnerability.
-
Medium 5.5
Podman Symlink Vulnerability
An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during a copy operation from the container to the host, because an undesired glob operation occurs. An attacker could create a container image containing parti…
-
High 7.8
An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka …
KEV Mar 15, 2022 -
Medium 6.2
Cisco IOS XE Software Arbitrary Code Execution Vulnerability
A vulnerability in the filesystem of Cisco IOS XE Software could allow an authenticated, local attacker with physical access to an affected device to execute arbitrary code on the underlying operating system (OS) with root privileges. The vulnerability is due…
-
High 7.8
An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To …
KEV Mar 15, 2022 -
High 7.5
Arbitrary file overwrite in tar-rs
An issue was discovered in the tar crate before 0.4.16 for Rust. Arbitrary file overwrite can occur via a symlink or hardlink in a TAR archive.
-
High 7.5
LNK Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose acco…
-
High 7.5
Podman Path Traversal Vulnerability leads to arbitrary file read/write
A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when …
-
High 7.8CVE-2019-1130 Exploited · Ransomware
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard l…
KEV May 23, 2022 -
High 7.8CVE-2019-1129 Exploited · Ransomware
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard l…
KEV Mar 15, 2022 -
High 7.5
b3log Wide unauthenticated file access
b3log Wide before 1.6.0 allows three types of attacks to access arbitrary files. First, the attacker can write code in the editor, and compile and run it approximately three times to read an arbitrary file. Second, the attacker can create a symlink, and then …
-
High 7.5
Arbitrary File Overwrite in fstream
fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted f…
-
High 7.8
Windows Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context. An attacker could then install p…
KEV Mar 15, 2022 -
High 7.8
Task Scheduler Elevation of Privilege Vulnerability
An elevation of privilege vulnerability exists in the way the Task Scheduler Service validates certain file operations. An attacker who successfully exploited the vulnerability could gain elevated privileges on a victim system. To exploit the vulnerability, a…
KEV Mar 15, 2022 -
High 7.1
dbus before 1.10.28, 1.12.x before 1.12.16, and 1.13.x before 1.13.12, as used in DBusServer in Canonical Upstart in Ub…
-
High 7.5
Arbitrary File Overwrite in tar
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file …
-
Medium 5.1
Mercurial Path Traversal/Link Following vulnerability
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
-
High 7.8
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard l…
KEV Mar 15, 2022 -
Medium 6.4
kubectl cp path traversal
The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in …
-
High 8.8
It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was in…
-
High 7.5
Jekyll allows attackers to access arbitrary files by specifying a symlink
Jekyll through 3.6.2, 3.7.x through 3.7.3, and 3.8.x through 3.8.3 allows attackers to access arbitrary files by specifying a symlink in the "include" key in the "_config.yml" file.
-
High 8.8
A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point t…
-
High 7.5
Insecure temporary file handling
pyro before 3.15 unsafely handles pid files in temporary directory locations and opening the pid file as root. An attacker can use this flaw to overwrite arbitrary files via symlinks.
-
High 7.3
It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a direct…
-
High 8.8
A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remot…
-
Medium 6.7CVE-2016-8641 Public exploit
A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary fi…
-
Medium 6.5
Privilege escalation flaws were found in the Red Hat initialization scripts of PostgreSQL. An attacker with access to t…
-
Critical 9.8
Rubyzip gem contains a Directory Traversal vulnerability in zip file component
rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , a…
-
Critical 9.8
Phusion Passenger SpawningKit Contains Arbitrary Read/Write Vulnerability
During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories in the spawning communication directory with symlinks. This then could result in…