CWE-59
AllowedImproper Link Resolution Before File Access ('Link Following')
Abstraction: Base · Status: Draft
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
2305 vulnerabilities reference this CWE, most recent first.
GHSA-QHFC-5XCH-PG48
Vulnerability from github – Published: 2022-05-02 06:12 – Updated: 2022-05-02 06:12The edit_cmd function in crontab.c in (1) cronie before 1.4.4 and (2) Vixie cron (vixie-cron) allows local users to change the modification times of arbitrary files, and consequently cause a denial of service, via a symlink attack on a temporary file in the /tmp directory.
{
"affected": [],
"aliases": [
"CVE-2010-0424"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-02-25T19:30:00Z",
"severity": "LOW"
},
"details": "The edit_cmd function in crontab.c in (1) cronie before 1.4.4 and (2) Vixie cron (vixie-cron) allows local users to change the modification times of arbitrary files, and consequently cause a denial of service, via a symlink attack on a temporary file in the /tmp directory.",
"id": "GHSA-qhfc-5xch-pg48",
"modified": "2022-05-02T06:12:38Z",
"published": "2022-05-02T06:12:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0424"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=565809"
},
{
"type": "WEB",
"url": "http://git.fedorahosted.org/git/cronie.git?p=cronie.git%3Ba=commit%3Bh=9e4a8fa5f9171fb724981f53879c9b20264aeb61"
},
{
"type": "WEB",
"url": "http://git.fedorahosted.org/git/cronie.git?p=cronie.git;a=commit;h=9e4a8fa5f9171fb724981f53879c9b20264aeb61"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035762.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/38700"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/38741"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/48104"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/38391"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-QHPV-F2H3-4MH8
Vulnerability from github – Published: 2022-05-17 01:07 – Updated: 2022-05-17 01:07Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename.
{
"affected": [],
"aliases": [
"CVE-2015-5705"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-09-06T21:29:00Z",
"severity": "HIGH"
},
"details": "Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename.",
"id": "GHSA-qhpv-f2h3-4mh8",
"modified": "2022-05-17T01:07:23Z",
"published": "2022-05-17T01:07:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5705"
},
{
"type": "WEB",
"url": "https://anonscm.debian.org/cgit/collab-maint/devscripts.git/commit/?id=d8f8fa1d8e4151fa62997cb74403f97ab0d7e1a2"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=794260"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1249645"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163705.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163710.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2015/08/01/7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QJ42-4Q8C-3R9V
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-05-24 19:10There is an information leak vulnerability in the digital media player (DMS) of ZTE's residential gateway product. The attacker could insert the USB disk with the symbolic link into the residential gateway, and access unauthorized directory information through the symbolic link, causing information leak.
{
"affected": [],
"aliases": [
"CVE-2021-21740"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-09T16:15:00Z",
"severity": "LOW"
},
"details": "There is an information leak vulnerability in the digital media player (DMS) of ZTE\u0027s residential gateway product. The attacker could insert the USB disk with the symbolic link into the residential gateway, and access unauthorized directory information through the symbolic link, causing information leak.",
"id": "GHSA-qj42-4q8c-3r9v",
"modified": "2022-05-24T19:10:26Z",
"published": "2022-05-24T19:10:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21740"
},
{
"type": "WEB",
"url": "https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1017244"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-QJ96-83MW-F2RW
Vulnerability from github – Published: 2022-11-02 12:00 – Updated: 2022-11-02 19:00This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13. Processing a maliciously crafted DMG file may lead to arbitrary code execution with system privileges.
{
"affected": [],
"aliases": [
"CVE-2022-32905"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-01T20:15:00Z",
"severity": "HIGH"
},
"details": "This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13. Processing a maliciously crafted DMG file may lead to arbitrary code execution with system privileges.",
"id": "GHSA-qj96-83mw-f2rw",
"modified": "2022-11-02T19:00:23Z",
"published": "2022-11-02T12:00:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32905"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT213488"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QJC9-F8HG-MV2P
Vulnerability from github – Published: 2025-12-02 21:31 – Updated: 2025-12-02 21:31JumpCloud Remote Assist for Windows versions prior to 0.317.0 include an uninstaller that is invoked by the JumpCloud Windows Agent as NT AUTHORITY\SYSTEM during agent uninstall or update operations. The Remote Assist uninstaller performs privileged create, write, execute, and delete actions on predictable files inside a user-writable %TEMP% subdirectory without validating that the directory is trusted or resetting its ACLs when it already exists. A local, low-privileged attacker can pre-create the directory with weak permissions and leverage mount-point or symbolic-link redirection to (a) coerce arbitrary file writes to protected locations, leading to denial of service (e.g., by overwriting sensitive system files), or (b) win a race to redirect DeleteFileW() to attacker-chosen targets, enabling arbitrary file or folder deletion and local privilege escalation to SYSTEM. This issue is fixed in JumpCloud Remote Assist 0.317.0 and affects Windows systems where Remote Assist is installed and managed through the Agent lifecycle.
{
"affected": [],
"aliases": [
"CVE-2025-34352"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-02T19:15:49Z",
"severity": "HIGH"
},
"details": "JumpCloud Remote Assist for Windows versions prior to 0.317.0 include an uninstaller that is invoked by the JumpCloud Windows Agent as NT AUTHORITY\\SYSTEM during agent uninstall or update operations. The Remote Assist uninstaller performs privileged create, write, execute, and delete actions on predictable files inside a user-writable %TEMP% subdirectory without validating that the directory is trusted or resetting its ACLs when it already exists. A local, low-privileged attacker can pre-create the directory with weak permissions and leverage mount-point or symbolic-link redirection to (a) coerce arbitrary file writes to protected locations, leading to denial of service (e.g., by overwriting sensitive system files), or (b) win a race to redirect DeleteFileW() to attacker-chosen targets, enabling arbitrary file or folder deletion and local privilege escalation to SYSTEM. This issue is fixed in JumpCloud Remote Assist 0.317.0 and affects Windows systems where Remote Assist is installed and managed through the Agent lifecycle.",
"id": "GHSA-qjc9-f8hg-mv2p",
"modified": "2025-12-02T21:31:29Z",
"published": "2025-12-02T21:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34352"
},
{
"type": "WEB",
"url": "https://jumpcloud.com/platform/remote-assistance"
},
{
"type": "WEB",
"url": "https://jumpcloud.com/support/list-of-jumpcloud-agent-release-notes"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/jumpcloud-remote-assist-arbitrary-file-write-delete-via-insecure-temp-directory"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-QJFR-H47V-47C8
Vulnerability from github – Published: 2026-09-08 18:32 – Updated: 2026-09-08 18:32Improper link resolution before file access ('link following') in Windows Container Manager Service allows an authorized attacker to bypass a security feature locally.
{
"affected": [],
"aliases": [
"CVE-2026-69771"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-08T18:19:48Z",
"severity": "MODERATE"
},
"details": "Improper link resolution before file access (\u0027link following\u0027) in Windows Container Manager Service allows an authorized attacker to bypass a security feature locally.",
"id": "GHSA-qjfr-h47v-47c8",
"modified": "2026-09-08T18:32:58Z",
"published": "2026-09-08T18:32:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69771"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69771"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-QJQ3-WQJ5-G37Q
Vulnerability from github – Published: 2026-05-27 15:33 – Updated: 2026-07-01 19:26Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries.
This allows attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.
Pipeline: Groovy Libraries Plugin 798.v5cc688825312 prohibits symbolic links in shared libraries.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "io.jenkins.plugins:pipeline-groovy-lib"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "798.v5cc688825312"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-48921"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-01T19:26:57Z",
"nvd_published_at": "2026-05-27T15:16:31Z",
"severity": "HIGH"
},
"details": "Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries.\n\nThis allows attackers able to control the content of a library used by a Pipeline job to read arbitrary files on the Jenkins controller filesystem.\n\nPipeline: Groovy Libraries Plugin 798.v5cc688825312 prohibits symbolic links in shared libraries.",
"id": "GHSA-qjq3-wqj5-g37q",
"modified": "2026-07-01T19:26:57Z",
"published": "2026-05-27T15:33:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48921"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/pipeline-groovy-lib-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2026-05-27/#SECURITY-3727"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Pipeline: Groovy Libraries Plugin does not prohibit symbolic links in shared libraries"
}
GHSA-QJVR-7M59-JJ7M
Vulnerability from github – Published: 2022-05-02 00:05 – Updated: 2022-05-02 00:05gather-messages.sh in Ampache 3.4.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/filelist temporary file.
{
"affected": [],
"aliases": [
"CVE-2008-3929"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-09-04T18:41:00Z",
"severity": "HIGH"
},
"details": "gather-messages.sh in Ampache 3.4.1 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/filelist temporary file.",
"id": "GHSA-qjvr-7m59-jj7m",
"modified": "2022-05-02T00:05:05Z",
"published": "2022-05-02T00:05:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-3929"
},
{
"type": "WEB",
"url": "https://bugs.gentoo.org/show_bug.cgi?id=235770"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44739"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496369"
},
{
"type": "WEB",
"url": "http://dev.gentoo.org/~rbu/security/debiantemp/ampache"
},
{
"type": "WEB",
"url": "http://freshmeat.net/projects/ampache/releases/283935"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31657"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/33316"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-200812-22.xml"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2008/10/30/2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/30875"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-QM4Q-4X5C-F7JF
Vulnerability from github – Published: 2026-09-15 21:33 – Updated: 2026-09-15 21:33An insufficient check allowed for the overwrite of arbitrary files via a symlink.
{
"affected": [],
"aliases": [
"CVE-2026-68491"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-15T21:16:42Z",
"severity": "CRITICAL"
},
"details": "An insufficient check allowed for the overwrite of arbitrary files via a symlink.",
"id": "GHSA-qm4q-4x5c-f7jf",
"modified": "2026-09-15T21:33:04Z",
"published": "2026-09-15T21:33:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68491"
},
{
"type": "WEB",
"url": "https://docs.solusvm.com/en/solusvm1/release-notes/mainline-branch/v1.30/#13015"
},
{
"type": "WEB",
"url": "https://docs.solusvm.com/en/solusvm1/release-notes/stable-branch/v1.30/#13015"
},
{
"type": "WEB",
"url": "https://support.solusvm.com/hc/en-us/articles/43503583489687-CVE-2026-68491-Vulnerability-in-SolusVM-1-allows-Guest-to-Host-privilege-escalation"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-QM7H-F635-H2R6
Vulnerability from github – Published: 2026-07-15 18:31 – Updated: 2026-07-15 21:31Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The destructive effect is performed at open-time via O_TRUNC, and can happen before full input validation completes (“truncation-before-validation”).
{
"affected": [],
"aliases": [
"CVE-2026-61371"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-15T16:16:50Z",
"severity": "HIGH"
},
"details": "Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The destructive effect is performed at open-time via O_TRUNC, and can happen before full input validation completes (\u201ctruncation-before-validation\u201d).",
"id": "GHSA-qm7h-f635-h2r6",
"modified": "2026-07-15T21:31:21Z",
"published": "2026-07-15T18:31:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61371"
},
{
"type": "WEB",
"url": "https://github.com/microsoft/avml/pull/754"
},
{
"type": "WEB",
"url": "https://gist.github.com/thesmartshadow/2d099071f847de8db3dc4bbaf4dfa6df"
},
{
"type": "WEB",
"url": "https://github.com/microsoft/avml/releases/tag/v0.17.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-48.1
Strategy: Separation of Privilege
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack
An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.