Common Weakness Enumeration

CWE-59

Allowed

Improper Link Resolution Before File Access ('Link Following')

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

2305 vulnerabilities reference this CWE, most recent first.

GHSA-R65Q-QPW9-V3QF

Vulnerability from github – Published: 2024-03-21 00:30 – Updated: 2024-03-21 00:30
VLAI
Details

Xbox Gaming Services Elevation of Privilege Vulnerability

Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-28916"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-21T00:15:09Z",
    "severity": "HIGH"
  },
  "details": "Xbox Gaming Services Elevation of Privilege Vulnerability",
  "id": "GHSA-r65q-qpw9-v3qf",
  "modified": "2024-03-21T00:30:56Z",
  "published": "2024-03-21T00:30:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28916"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28916"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-R6GQ-WHWQ-MVG9

Vulnerability from github – Published: 2026-09-08 15:26 – Updated: 2026-09-08 15:26
VLAI
Summary
NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root
Details

Summary

nltk.corpus.reader.api.CorpusReader.open() can be used to read files outside the intended corpus root via a symlink placed inside that root. Although NLTK blocks absolute paths and .. traversal, the current boundary check is only lexical and does not account for symlink resolution. This leads to an arbitrary local file read / filesystem sandbox bypass for applications that rely on CorpusReader or FileSystemPathPointer to restrict file access.

Details

The vulnerable flow is:

  • nltk/corpus/reader/api.py:222

  • CorpusReader.open() blocks absolute paths and .., then calls self._root.join(file).open()

  • nltk/data.py:398

  • FileSystemPathPointer.join() joins the requested file ID and checks whether the resulting path still appears to remain under the configured root

The problem is that the check is based on the lexical path after os.path.normpath(), not on the resolved path after following symlinks.

Current behavior:

  1. CorpusReader.open() rejects:
  2. absolute paths
  3. .. path traversal
  4. FileSystemPathPointer.join() computes:
  5. joined = os.path.normpath(os.path.join(self._path, fileid))
  6. root = os.path.normpath(self._path)
  7. It allows the access if joined starts with root

This misses the case where a path stays inside the root lexically, but resolves outside the root via a symlink already present under the allowed directory.

Example:

JOINED=/tmp/nltk-root/link/secret.txt
REALPATH=/tmp/outside/secret.txt

JOINED still appears to be inside the root, but REALPATH is outside it.

This is distinct from simple ../ traversal:

  • the file ID is not absolute
  • the file ID does not contain ..
  • the escape only happens after filesystem resolution of a symlink under the allowed root

PoC

Reproduced in an isolated Docker sandbox using the local nltk clone.

Minimal Python PoC:

import os
import tempfile
from nltk.corpus.reader.api import CorpusReader

root = tempfile.mkdtemp(prefix="nltk-root-")
outside_dir = tempfile.mkdtemp(prefix="nltk-out-")
outside_file = os.path.join(outside_dir, "secret.txt")

with open(outside_file, "w") as f:
    f.write("secret-data")

os.symlink(outside_dir, os.path.join(root, "link"))

corpus = CorpusReader(root, ["link/secret.txt"])
with corpus.open("link/secret.txt") as f:
    print(f.read())

Observed result:

secret-data

Docker re-test output:

ROOT=/tmp/nltk-root-jjxay3if
OUTSIDE_DIR=/tmp/nltk-out-1kef36e0
JOINED=/tmp/nltk-root-jjxay3if/link/secret.txt
REALPATH=/tmp/nltk-out-1kef36e0/secret.txt
READ_OK=secret-data
INSIDE_ROOT=True
REAL_INSIDE_ROOT=False

Additional impact validation using a system file:

ROOT=/tmp/nltk-root-_h5x4m19
JOINED=/tmp/nltk-root-_h5x4m19/hostfile
REALPATH=/etc/hostname
HOSTNAME_READ=48dafb244af3
INSIDE_ROOT=True
REAL_INSIDE_ROOT=False

This shows that the issue is not limited to attacker-created files outside the root; it can also read existing system files that are readable by the application user.

Impact

This is an arbitrary local file read / symlink escape issue.

Who is impacted:

  • applications that accept attacker-controlled corpus directories, extracted datasets, or package contents
  • applications that rely on NLTK corpus readers as a trust boundary for file access
  • any deployment where an attacker can place or influence files inside the allowed corpus root

Practical impact includes disclosure of:

  • application secrets stored on disk
  • local configuration files
  • private datasets
  • process-exposed files such as /proc/self/environ
  • system files readable by the running user

The issue is best described as a filesystem sandbox bypass caused by improper link resolution before file access.

Severity
6.2 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
8.6 (High)
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.9.3"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "nltk"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.9.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-70626"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-08T15:26:47Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n`nltk.corpus.reader.api.CorpusReader.open()` can be used to read files outside the intended corpus root via a symlink placed inside that root. Although NLTK blocks absolute paths and `..` traversal, the current boundary check is only lexical and does not account for symlink resolution. This leads to an arbitrary local file read / filesystem sandbox bypass for applications that rely on `CorpusReader` or `FileSystemPathPointer` to restrict file access.\n\n### Details\nThe vulnerable flow is:\n\n- [`nltk/corpus/reader/api.py:222`](/mnt/Data/my_brains/test/nltk/nltk/corpus/reader/api.py#L222)\n  - `CorpusReader.open()` blocks absolute paths and `..`, then calls `self._root.join(file).open()`\n\n- [`nltk/data.py:398`](/mnt/Data/my_brains/test/nltk/nltk/data.py#L398)\n  - `FileSystemPathPointer.join()` joins the requested file ID and checks whether the resulting path still appears to remain under the configured root\n\nThe problem is that the check is based on the lexical path after `os.path.normpath()`, not on the resolved path after following symlinks.\n\nCurrent behavior:\n\n1. `CorpusReader.open()` rejects:\n   - absolute paths\n   - `..` path traversal\n2. `FileSystemPathPointer.join()` computes:\n   - `joined = os.path.normpath(os.path.join(self._path, fileid))`\n   - `root = os.path.normpath(self._path)`\n3. It allows the access if `joined` starts with `root`\n\nThis misses the case where a path stays inside the root lexically, but resolves outside the root via a symlink already present under the allowed directory.\n\nExample:\n\n```text\nJOINED=/tmp/nltk-root/link/secret.txt\nREALPATH=/tmp/outside/secret.txt\n```\n\n`JOINED` still appears to be inside the root, but `REALPATH` is outside it.\n\nThis is distinct from simple `../` traversal:\n\n- the file ID is not absolute\n- the file ID does not contain `..`\n- the escape only happens after filesystem resolution of a symlink under the allowed root\n\n### PoC\nReproduced in an isolated Docker sandbox using the local `nltk` clone.\n\nMinimal Python PoC:\n\n```python\nimport os\nimport tempfile\nfrom nltk.corpus.reader.api import CorpusReader\n\nroot = tempfile.mkdtemp(prefix=\"nltk-root-\")\noutside_dir = tempfile.mkdtemp(prefix=\"nltk-out-\")\noutside_file = os.path.join(outside_dir, \"secret.txt\")\n\nwith open(outside_file, \"w\") as f:\n    f.write(\"secret-data\")\n\nos.symlink(outside_dir, os.path.join(root, \"link\"))\n\ncorpus = CorpusReader(root, [\"link/secret.txt\"])\nwith corpus.open(\"link/secret.txt\") as f:\n    print(f.read())\n```\n\nObserved result:\n\n```text\nsecret-data\n```\n\nDocker re-test output:\n\n```text\nROOT=/tmp/nltk-root-jjxay3if\nOUTSIDE_DIR=/tmp/nltk-out-1kef36e0\nJOINED=/tmp/nltk-root-jjxay3if/link/secret.txt\nREALPATH=/tmp/nltk-out-1kef36e0/secret.txt\nREAD_OK=secret-data\nINSIDE_ROOT=True\nREAL_INSIDE_ROOT=False\n```\n\nAdditional impact validation using a system file:\n\n```text\nROOT=/tmp/nltk-root-_h5x4m19\nJOINED=/tmp/nltk-root-_h5x4m19/hostfile\nREALPATH=/etc/hostname\nHOSTNAME_READ=48dafb244af3\nINSIDE_ROOT=True\nREAL_INSIDE_ROOT=False\n```\n\nThis shows that the issue is not limited to attacker-created files outside the root; it can also read existing system files that are readable by the application user.\n\n### Impact\nThis is an arbitrary local file read / symlink escape issue.\n\nWho is impacted:\n\n- applications that accept attacker-controlled corpus directories, extracted datasets, or package contents\n- applications that rely on NLTK corpus readers as a trust boundary for file access\n- any deployment where an attacker can place or influence files inside the allowed corpus root\n\nPractical impact includes disclosure of:\n\n- application secrets stored on disk\n- local configuration files\n- private datasets\n- process-exposed files such as `/proc/self/environ`\n- system files readable by the running user\n\nThe issue is best described as a filesystem sandbox bypass caused by improper link resolution before file access.",
  "id": "GHSA-r6gq-whwq-mvg9",
  "modified": "2026-09-08T15:26:47Z",
  "published": "2026-09-08T15:26:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/nltk/nltk/security/advisories/GHSA-r6gq-whwq-mvg9"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-70626"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nltk/nltk/pull/3522"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nltk/nltk/commit/1b0e519e2324bc1a273d56edee63e44d0ad85b48"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nltk/nltk"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nltk/nltk/releases/tag/3.9.4"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/nltk/PYSEC-2026-3732.yaml"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/nltk-before-symlink-escape-via-corpusreader"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "NLTK: Symlink escape in CorpusReader allows arbitrary local file read outside the corpus root"
}

GHSA-R6GW-XG73-F977

Vulnerability from github – Published: 2022-05-14 02:07 – Updated: 2022-05-14 02:07
VLAI
Details

Gummi 0.6.5 allows local users to write to arbitrary files via a symlink attack on a temporary dot file that uses the name of an existing file and a (1) .aux, (2) .log, (3) .out, (4) .pdf, or (5) .toc extension for the file name, as demonstrated by .thesis.tex.aux.

Severity
3.3 (Low)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2015-7758"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-01-08T19:59:00Z",
    "severity": "LOW"
  },
  "details": "Gummi 0.6.5 allows local users to write to arbitrary files via a symlink attack on a temporary dot file that uses the name of an existing file and a (1) .aux, (2) .log, (3) .out, (4) .pdf, or (5) .toc extension for the file name, as demonstrated by .thesis.tex.aux.",
  "id": "GHSA-r6gw-xg73-f977",
  "modified": "2022-05-14T02:07:50Z",
  "published": "2022-05-14T02:07:50Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7758"
    },
    {
      "type": "WEB",
      "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=756432"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178582.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/178642.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2015-12/msg00117.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-updates/2016-02/msg00150.html"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2015/10/08/4"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2015/10/08/5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-R6QV-FRPC-Q66C

Vulnerability from github – Published: 2026-03-18 18:31 – Updated: 2026-03-19 23:22
VLAI
Summary
Jenkins has a link following vulnerability allows arbitrary file creation
Details

Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.554"
      },
      "package": {
        "ecosystem": "Maven",
        "name": "org.jenkins-ci.main:jenkins-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.555"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33001"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59",
      "CWE-61"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-19T12:46:21Z",
    "nvd_published_at": "2026-03-18T16:16:28Z",
    "severity": "HIGH"
  },
  "details": "Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins.\nThis can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes.",
  "id": "GHSA-r6qv-frpc-q66c",
  "modified": "2026-03-19T23:22:20Z",
  "published": "2026-03-18T18:31:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33001"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/jenkins/commit/6dc99937605d5bddfeaae43a4cd14c2571e23adc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jenkinsci/jenkins"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jenkinsci/jenkins/releases/tag/jenkins-2.555"
    },
    {
      "type": "WEB",
      "url": "https://www.jenkins.io/security/advisory/2026-03-18/#SECURITY-3657"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Jenkins has a link following vulnerability allows arbitrary file creation"
}

GHSA-R798-GF85-6MC8

Vulnerability from github – Published: 2022-04-29 01:27 – Updated: 2024-02-16 21:31
VLAI
Details

mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode without the Apache log, allows local users to overwrite arbitrary files via (1) a symlink attack on predictable temporary filenames on Unix systems, or (2) an NTFS hard link on Windows systems when the "Strengthen default permissions of internal system objects" policy is not enabled.

Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2003-0844"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2003-11-17T05:00:00Z",
    "severity": "LOW"
  },
  "details": "mod_gzip 1.3.26.1a and earlier, and possibly later official versions, when running in debug mode without the Apache log, allows local users to overwrite arbitrary files via (1) a symlink attack on predictable temporary filenames on Unix systems, or (2) an NTFS hard link on Windows systems when the \"Strengthen default permissions of internal system objects\" policy is not enabled.",
  "id": "GHSA-r798-gf85-6mc8",
  "modified": "2024-02-16T21:31:29Z",
  "published": "2022-04-29T01:27:06Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2003-0844"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=105457180009860\u0026w=2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-R7XJ-75MX-FCRR

Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2022-05-24 19:03
VLAI
Details

Private Tunnel installer for macOS version 3.0.1 and older versions may corrupt system critical files it should not have access via symlinks in /tmp.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2020-15076"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-26T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "Private Tunnel installer for macOS version 3.0.1 and older versions may corrupt system critical files it should not have access via symlinks in /tmp.",
  "id": "GHSA-r7xj-75mx-fcrr",
  "modified": "2022-05-24T19:03:18Z",
  "published": "2022-05-24T19:03:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15076"
    },
    {
      "type": "WEB",
      "url": "https://swupdate.openvpn.net/downloads/privatetunnel/changelog.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-R82W-5VRW-9X74

Vulnerability from github – Published: 2022-05-02 03:14 – Updated: 2022-05-02 03:14
VLAI
Details

Apple Safari 3.2.1 (aka AppVer 3.525.27.1) on Windows allows remote attackers to cause a denial of service (infinite loop or access violation) via a link to an http URI in which the authority (aka hostname) portion is either a (1) . (dot) or (2) .. (dot dot) sequence.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2009-0321"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2009-01-28T18:30:00Z",
    "severity": "MODERATE"
  },
  "details": "Apple Safari 3.2.1 (aka AppVer 3.525.27.1) on Windows allows remote attackers to cause a denial of service (infinite loop or access violation) via a link to an http URI in which the authority (aka hostname) portion is either a (1) . (dot) or (2) .. (dot dot) sequence.",
  "id": "GHSA-r82w-5vrw-9x74",
  "modified": "2022-05-02T03:14:19Z",
  "published": "2022-05-02T03:14:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0321"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48284"
    },
    {
      "type": "WEB",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6091"
    },
    {
      "type": "WEB",
      "url": "http://lostmon.blogspot.com/2009/01/safari-for-windows-321-remote-http-uri.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/33481"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-R8JG-Q736-V263

Vulnerability from github – Published: 2022-05-17 04:50 – Updated: 2022-05-17 04:50
VLAI
Details

lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving .cups/client.conf.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2013-6891"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-01-26T01:55:00Z",
    "severity": "LOW"
  },
  "details": "lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving .cups/client.conf.",
  "id": "GHSA-r8jg-q736-v263",
  "modified": "2022-05-17T04:50:44Z",
  "published": "2022-05-17T04:50:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6891"
    },
    {
      "type": "WEB",
      "url": "http://advisories.mageia.org/MGASA-2014-0021.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/56531"
    },
    {
      "type": "WEB",
      "url": "http://www.cups.org/blog.php?L704"
    },
    {
      "type": "WEB",
      "url": "http://www.cups.org/str.php?L4319"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2014:015"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-2082-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-R8MW-W9VJ-P395

Vulnerability from github – Published: 2022-05-17 05:53 – Updated: 2022-05-17 05:53
VLAI
Details

sdm-login in sdm-terminal 0.4.0b allows local users to overwrite arbitrary files via a symlink attack on the /tmp/sdm.autologin.once temporary file.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2008-5372"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2008-12-08T23:30:00Z",
    "severity": "MODERATE"
  },
  "details": "sdm-login in sdm-terminal 0.4.0b allows local users to overwrite arbitrary files via a symlink attack on the /tmp/sdm.autologin.once temporary file.",
  "id": "GHSA-r8mw-w9vj-p395",
  "modified": "2022-05-17T05:53:19Z",
  "published": "2022-05-17T05:53:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-5372"
    },
    {
      "type": "WEB",
      "url": "http://lists.debian.org/debian-devel/2008/08/msg00283.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-R936-W9VP-C53Q

Vulnerability from github – Published: 2022-05-13 01:38 – Updated: 2025-04-20 03:48
VLAI
Details

PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server.

Severity
6.7 (Medium)
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2017-12172"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-11-22T19:29:00Z",
    "severity": "HIGH"
  },
  "details": "PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run arbitrary code under that system account. PostgreSQL provides a script for starting the database server during system boot. Packages of PostgreSQL for many operating systems provide their own, packager-authored startup implementations. Several implementations use a log file name that the database superuser can replace with a symbolic link. As root, they open(), chmod() and/or chown() this log file name. This often suffices for the database superuser to escalate to root privileges when root starts the server.",
  "id": "GHSA-r936-w9vp-c53q",
  "modified": "2025-04-20T03:48:53Z",
  "published": "2022-05-13T01:38:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12172"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2017:3402"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2017:3403"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2017:3404"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2017:3405"
    },
    {
      "type": "WEB",
      "url": "https://www.postgresql.org/about/news/1801"
    },
    {
      "type": "WEB",
      "url": "https://www.postgresql.org/support/security"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/101949"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1039752"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation MIT-48.1
Architecture and Design

Strategy: Separation of Privilege

  • Follow the principle of least privilege when assigning access rights to entities in a software system.
  • Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack

An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.

CAPEC-17: Using Malicious Files

An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.

CAPEC-35: Leverage Executable Code in Non-Executable Files

An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.

CAPEC-76: Manipulating Web Input to File System Calls

An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.

← Back to the CWE list