CWE-59
AllowedImproper Link Resolution Before File Access ('Link Following')
Abstraction: Base · Status: Draft
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
1995 vulnerabilities reference this CWE, most recent first.
GHSA-M543-3MP9-RFGF
Vulnerability from github – Published: 2022-05-24 19:07 – Updated: 2022-07-03 00:00A vulnerability in share_link in QSAN Storage Manager allows remote attackers to create a symbolic link then access arbitrary files.
{
"affected": [],
"aliases": [
"CVE-2021-32518"
],
"database_specific": {
"cwe_ids": [
"CWE-59",
"CWE-61"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-07T14:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability in share_link in QSAN Storage Manager allows remote attackers to create a symbolic link then access arbitrary files.",
"id": "GHSA-m543-3mp9-rfgf",
"modified": "2022-07-03T00:00:23Z",
"published": "2022-05-24T19:07:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32518"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-4874-79edc-1.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M545-63MF-QH6W
Vulnerability from github – Published: 2022-05-17 01:54 – Updated: 2022-05-17 01:54The do_dump_data function in utils/opcontrol in OProfile 0.9.6 and earlier might allow local users to create or overwrite arbitrary files via a crafted --session-dir argument in conjunction with a symlink attack on the opd_pipe file, a different vulnerability than CVE-2011-1760.
{
"affected": [],
"aliases": [
"CVE-2011-2473"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-06-09T21:55:00Z",
"severity": "MODERATE"
},
"details": "The do_dump_data function in utils/opcontrol in OProfile 0.9.6 and earlier might allow local users to create or overwrite arbitrary files via a crafted --session-dir argument in conjunction with a symlink attack on the opd_pipe file, a different vulnerability than CVE-2011-1760.",
"id": "GHSA-m545-63mf-qh6w",
"modified": "2022-05-17T01:54:56Z",
"published": "2022-05-17T01:54:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-2473"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/67978"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=624212"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2011/05/03/1"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2011/05/10/6"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2011/05/10/7"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2011/05/11/1"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2011/dsa-2254"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-M5CG-XH84-2P2R
Vulnerability from github – Published: 2022-05-02 06:10 – Updated: 2025-04-11 03:31Bournal before 1.4.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified temporary files associated with a --hack_the_gibson update check.
{
"affected": [],
"aliases": [
"CVE-2010-0118"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-02-25T00:30:00Z",
"severity": "LOW"
},
"details": "Bournal before 1.4.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified temporary files associated with a --hack_the_gibson update check.",
"id": "GHSA-m5cg-xh84-2p2r",
"modified": "2025-04-11T03:31:46Z",
"published": "2022-05-02T06:10:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0118"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036697.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036701.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-March/036764.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/38554"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/38814"
},
{
"type": "WEB",
"url": "http://secunia.com/secunia_research/2010-6"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/509685/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/38353"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-M5F7-XX8H-V9X2
Vulnerability from github – Published: 2022-05-17 02:18 – Updated: 2022-05-17 02:18geo-code in gpsdrive-scripts 2.10~pre4 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/geo.google, (2) /tmp/geo.yahoo, (3) /tmp/geo.coords, and (4) /tmp/geo#####.coords temporary files.
{
"affected": [],
"aliases": [
"CVE-2008-4959"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-11-05T15:00:00Z",
"severity": "MODERATE"
},
"details": "geo-code in gpsdrive-scripts 2.10~pre4 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/geo.google, (2) /tmp/geo.yahoo, (3) /tmp/geo.coords, and (4) /tmp/geo#####.coords temporary files.",
"id": "GHSA-m5f7-xx8h-v9x2",
"modified": "2022-05-17T02:18:32Z",
"published": "2022-05-17T02:18:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4959"
},
{
"type": "WEB",
"url": "https://bugs.gentoo.org/show_bug.cgi?id=235770"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44759"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00187.html"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/496436"
},
{
"type": "WEB",
"url": "http://dev.gentoo.org/~rbu/security/debiantemp/gpsdrive-scripts"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31694"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/33825"
},
{
"type": "WEB",
"url": "http://uvw.ru/report.lenny.txt"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2008/10/30/2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/30905"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-M5FG-QJQ5-56FV
Vulnerability from github – Published: 2026-07-10 00:31 – Updated: 2026-07-10 18:32decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries (type === 'symlink'), the x.linkname field from the archive is passed directly to fs.symlink() without validation (index.js line 121). The preventWritingThroughSymlink check on line 98 only applies to file entries, not symlink creation. An attacker can craft an archive with symlink entries pointing to sensitive files outside the extraction directory (e.g., /etc/passwd), enabling information disclosure when the application reads the extracted contents.
{
"affected": [],
"aliases": [
"CVE-2026-39246"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-09T22:17:04Z",
"severity": "HIGH"
},
"details": "decompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When processing symlink entries (type === \u0027symlink\u0027), the x.linkname field from the archive is passed directly to fs.symlink() without validation (index.js line 121). The preventWritingThroughSymlink check on line 98 only applies to file entries, not symlink creation. An attacker can craft an archive with symlink entries pointing to sensitive files outside the extraction directory (e.g., /etc/passwd), enabling information disclosure when the application reads the extracted contents.",
"id": "GHSA-m5fg-qjq5-56fv",
"modified": "2026-07-10T18:32:08Z",
"published": "2026-07-10T00:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39246"
},
{
"type": "WEB",
"url": "https://github.com/kevva/decompress/issues/114"
},
{
"type": "WEB",
"url": "https://github.com/kevva/decompress"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/decompress"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M5MM-7F4V-27V9
Vulnerability from github – Published: 2022-05-14 03:30 – Updated: 2022-05-14 03:30In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before 5.5.8 (the fixed version for 5.5.x), 5.6.0 before 5.6.5 (the fixed version for 5.6.x), 5.7.0 before 5.7.3 (the fixed version for 5.7.x), and 5.8.0 before 5.8.2 (the fixed version for 5.8.x), allows authenticated users to gain remote code execution using the in browser editing feature via editing a symbolic link within a repository.
{
"affected": [],
"aliases": [
"CVE-2018-5225"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-03-22T13:29:00Z",
"severity": "CRITICAL"
},
"details": "In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7), 5.5.0 before 5.5.8 (the fixed version for 5.5.x), 5.6.0 before 5.6.5 (the fixed version for 5.6.x), 5.7.0 before 5.7.3 (the fixed version for 5.7.x), and 5.8.0 before 5.8.2 (the fixed version for 5.8.x), allows authenticated users to gain remote code execution using the in browser editing feature via editing a symbolic link within a repository.",
"id": "GHSA-m5mm-7f4v-27v9",
"modified": "2022-05-14T03:30:14Z",
"published": "2022-05-14T03:30:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5225"
},
{
"type": "WEB",
"url": "https://confluence.atlassian.com/x/3WNsO"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/BSERV-10684"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/103488"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M633-G3VP-7QW3
Vulnerability from github – Published: 2026-05-12 15:31 – Updated: 2026-05-12 15:31The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper that may allow reading an out-of-sandbox file. This vulnerability (CVE-2026-5061) is fixed in consul-template 0.42.0.
{
"affected": [],
"aliases": [
"CVE-2026-5061"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-12T15:16:16Z",
"severity": "MODERATE"
},
"details": "The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper that may allow reading an out-of-sandbox file. This vulnerability (CVE-2026-5061) is fixed in consul-template 0.42.0.",
"id": "GHSA-m633-g3vp-7qw3",
"modified": "2026-05-12T15:31:41Z",
"published": "2026-05-12T15:31:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5061"
},
{
"type": "WEB",
"url": "https://discuss.hashicorp.com/t/hcsec-2026-12-consul-template-vulnerable-to-sandbox-path-bypass-in-file-helper-through-symlink-attack/77414"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-M699-6XJ6-M4HP
Vulnerability from github – Published: 2026-03-03 18:31 – Updated: 2026-03-04 18:31An issue in the WiseDelfile64.sys component of WiseCleaner Wise Force Deleter 7.3.2 and earlier allows attackers to delete arbitrary files via a crafted request.
{
"affected": [],
"aliases": [
"CVE-2025-66680"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-03T16:16:17Z",
"severity": "HIGH"
},
"details": "An issue in the WiseDelfile64.sys component of WiseCleaner Wise Force Deleter 7.3.2 and earlier allows attackers to delete arbitrary files via a crafted request.",
"id": "GHSA-m699-6xj6-m4hp",
"modified": "2026-03-04T18:31:49Z",
"published": "2026-03-03T18:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66680"
},
{
"type": "WEB",
"url": "https://github.com/cwjchoi01/CVE-2025-66680/tree/main"
},
{
"type": "WEB",
"url": "https://www.wisecleaner.com/wise-force-deleter.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-M6CX-G6QM-P2CX
Vulnerability from github – Published: 2019-12-13 15:39 – Updated: 2021-10-21 21:16Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to create files on a user's system when the package is installed. It is only possible to affect files that the user running npm install has access to and it is not possible to over write files that already exist on disk.
This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
Recommendation
Upgrade to version 6.13.3 or later.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "npm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.13.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-16775"
],
"database_specific": {
"cwe_ids": [
"CWE-59",
"CWE-61"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-17T16:30:50Z",
"nvd_published_at": "2019-12-13T01:15:00Z",
"severity": "HIGH"
},
"details": "Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to create files on a user\u0027s system when the package is installed. It is only possible to affect files that the user running `npm install` has access to and it is not possible to over write files that already exist on disk.\n\nThis behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.\n\n\n## Recommendation\n\nUpgrade to version 6.13.3 or later.",
"id": "GHSA-m6cx-g6qm-p2cx",
"modified": "2021-10-21T21:16:09Z",
"published": "2019-12-13T15:39:19Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/npm/cli/security/advisories/GHSA-m6cx-g6qm-p2cx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16775"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHEA-2020:0330"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:0573"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:0579"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:0597"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:0602"
},
{
"type": "WEB",
"url": "https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-m6cx-g6qm-p2cx"
},
{
"type": "PACKAGE",
"url": "https://github.com/npm/cli"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/advisories/1434"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2020.html"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Arbitrary File Write in npm"
}
GHSA-M6GQ-7H42-3FJ9
Vulnerability from github – Published: 2022-05-24 19:09 – Updated: 2022-05-24 19:09replay-sorcery-kms in Replay Sorcery 0.6.0 allows a local attacker to gain root privileges via a symlink attack on /tmp/replay-sorcery or /tmp/replay-sorcery/device.sock.
{
"affected": [],
"aliases": [
"CVE-2021-36983"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-30T14:15:00Z",
"severity": "HIGH"
},
"details": "replay-sorcery-kms in Replay Sorcery 0.6.0 allows a local attacker to gain root privileges via a symlink attack on /tmp/replay-sorcery or /tmp/replay-sorcery/device.sock.",
"id": "GHSA-m6gq-7h42-3fj9",
"modified": "2022-05-24T19:09:21Z",
"published": "2022-05-24T19:09:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36983"
},
{
"type": "WEB",
"url": "https://github.com/matanui159/ReplaySorcery/releases"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2021/07/27/1"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation MIT-48.1
Strategy: Separation of Privilege
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack
An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.