Weaknesses of type CWE-61

159 results

Seguimento de link simbólico UNIX não validado

Uma aplicação segue um link simbólico (symlink) sem validar para onde ele aponta, permitindo que um atacante redirecione operações de arquivo para locais arbitrários do sistema. Se o programa tem privilégios elevados, o atacante consegue ler, modificar ou deletar arquivos sensíveis fora do escopo pretendido.

Example

Um script de backup roda como root e processa arquivos em /tmp/dados. Um atacante cria um symlink /tmp/dados → /etc/passwd. Quando o script segue o link, ele acaba manipulando o arquivo de senhas do sistema em vez do arquivo de dados esperado.

How to mitigate

Valide symlinks antes de operar sobre eles: use funções como `realpath()` ou `readlink()` para verificar o caminho real e garantir que ele está dentro do diretório esperado. Alternativamente, configure permissões restritivas em diretórios temporários (use sticky bit em /tmp, ou crie diretórios privados) para impedir que outros usuários injetem symlinks maliciosos.

CVE-2024-28189CRITICALJudge0 vulnerable to Sandbox Escape Patch Bypass via chown running on Symbolic LinkEPSS 7.2%CVE-2024-28185CRITICALJudge0 vulnerable to Sandbox Escape via Symbolic LinkEPSS 7.1%CVE-2019-11249MEDIUMkubectl cp allows symlink directory traversalEPSS 3.7%CVE-2019-11246MEDIUMkubectl cp allows symlink directory traversalEPSS 3.6%CVE-2019-16775HIGHUnauthorized File Access in npm CLI before before version 6.13.3EPSS 3.3%CVE-2019-11251MEDIUMkubectl cp allows symlink directory traversalEPSS 2.6%CVE-2023-37460HIGHPlexus Archiver vulnerable to Arbitrary File Creation in AbstractUnArchiverEPSS 2.5%CVE-2022-3592MEDIUMA symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured shEPSS 2.4%CVE-2021-4287MEDIUMReFirm Labs binwalk Archive Extraction extractor.py symlinkEPSS 1.9%CVE-2026-34078CRITICALFlatpak has a complete sandbox escape leading to host file access and code execution in the host contextEPSS 1.7%CVE-2021-32518HIGHQSAN Storage Manager - UNIX Symbolic Link (Symlink) FollowingEPSS 1.7%CVE-2026-54420HIGHLiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTPEPSS 1.4%KEVCVE-2021-32508MEDIUMQSAN Storage Manager - UNIX Symbolic Link (Symlink) Following via FileStreaming functionEPSS 1.3%CVE-2021-32509MEDIUMQSAN Storage Manager - UNIX Symbolic Link (Symlink) Following via FileviewDoc functionEPSS 1.3%CVE-2021-1145MEDIUMCisco StarOS for Cisco ASR 5000 Series Routers Arbitrary File Read VulnerabilityEPSS 1.3%CVE-2022-24904MEDIUMSymlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-serverEPSS 1.1%CVE-2017-14798HIGHlocal privilege escalation in SUSE postgresql init scriptEPSS 1.0%CVE-2024-54148HIGHGogs has a Path Traversal in file editing UIEPSS 0.9%CVE-2025-55345HIGHUnsafe symlink following in restricted workspace-write sandbox leads to RCEEPSS 0.8%CVE-2022-31036MEDIUMSymlink following allows leaking out-of-bounds YAML files from Argo CD repo-serverEPSS 0.8%