Weakness (CWE)
CWE-59: Improper Link Resolution Before File Access
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
How to prevent it (1 mitigation)
-
Architecture and Design
Follow the principle of least privilege when assigning access rights to entities in a software system.
Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Source: MITRE CWE-59
1,132 results · Feed
-
High 7.6
Qemu before version 2.9 is vulnerable to an improper link following when built with the VirtFS. A privileged user insid…
-
Medium 5.9
Moderate severity vulnerability that affects org.springframework.boot:spring-boot
Spring Boot supports an embedded launch script that can be used to easily run the application as a systemd or init.d linux service. The script included with Spring Boot 1.5.9 and earlier and 2.0.0.M1 through 2.0.0.M7 is susceptible to a symlink attack which a…
-
High 7.5
RubyGems Link Following vulnerability
RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location fun…
-
Unscored —
Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entit…
-
High 7.8
systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local…
-
Medium 5.5
keycloak-httpd-client-install symlink attack vulnerability
keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link.
-
Medium 5.5
VladTheEnterprising allows local users to write to arbitrary files via a symlink attack
lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to write to arbitrary files via a symlink attack on /tmp/my.cnf.#{target_host}.
-
Medium 5.5
Numpy arbitrary file write via symlink attack
(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.
-
High 7.5
Syncthing vulnerable to symlink traversal and arbitrary file overwrite
Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite
-
Unscored —
It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An…
-
Unscored —
PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2…
-
High 7.8
SoSReport Predictable Tmp File Names
sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory, as demonstrated by sosreport-$hostname-$date.tar in /tmp/sosreport-$hostname-$dat…
-
Unscored —
A vulnerability in the web-based UI of Cisco Unified Communications Manager could allow an unauthenticated, remote atta…
-
High 7.5
Mercurial missing symlink check
Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository
-
Medium 6.4
instack-undercloud vulnerable to symlink attack on tmp files
A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temp…
-
Medium 5.5
Openstack DBaaS (Trove) Improper Link Resolution Before File Access
The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, write_config function in trove/guestagent/datastore/experimental/re…
-
High 7.8
Ansible Sandbox Escape via Symlink Attack
The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack.
-
High 7.5
Symlink Arbitrary File Overwrite in tar
The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.
-
High 7.8
Link Following in ansible
The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the ar…
-
High 7.8
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain per…
KEV Aug 26, 2026 -
High 8.4
Arbitrary File Write in Libcontainer
Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.
-
Medium —
Symlink Attack in Libcontainer and Docker Engine
Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.
-
High 7.8
The XPC implementation in Admin Framework in Apple OS X before 10.10.3 allows local users to bypass authentication and …
KEV Feb 10, 2022 -
Medium —
Typo3 Open Redirect In Frontend Rendering
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to a…
-
Medium 6.5
Directory Traversal in Docker
Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."
-
High 7.3
Arbitrary Code Execution in Docker
Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.
-
Medium —
Improper Link Resolution Before File Access in Apache Hadoop
The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive…
-
High —
SaltStack Salt Insecure Temporary File Creation
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.
-
Medium 4.5
eyeD3 is vulnerable to arbitrary file modification via symlink attack
tag.py in eyeD3 (aka python-eyed3) 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack on a temporary file.
-
Low —
Local Privilege Escalation in npm
lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.
-
Medium —
Script Injection in Show In Browser gem
The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html.
-
High 7.7
PIL and Pillow Vulnerable to Symlink Attack on Tmpfiles
The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not proper…
-
Medium 5.6
Improper Link Resolution Before File Access in logilab-commons
The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.
-
High 7.2
cpio, as used in build 2007.05.10, 2010.07.28, and possibly other versions, allows remote attackers to overwrite arbitr…
-
Low —
pyxdg Arbitrary File Overwrite via Race Condition
Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to…
-
Medium 5.0
systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for…
-
Medium —
insecure temporary directory usage in passenger
ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.
-
Medium 6.2CVE-2013-2217 Public exploit
Improper Link Resolution Before File Access in Suds
cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.
-
Medium 6.2
Improper Link Resolution Before File Access in pip
pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.
-
Medium 6.8
Incorrect Default Permissions in Apache Commons FileUpload
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.