GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Common Weakness Enumeration

CWE-59

Allowed

Improper Link Resolution Before File Access ('Link Following')

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

2249 vulnerabilities reference this CWE, most recent first.

CVE-2025-21195 (GCVE-0-2025-21195)

Vulnerability from cvelistv5 – Published: 2025-07-08 16:57 – Updated: 2026-02-13 19:06
VLAI
Title
Azure Service Fabric Runtime Elevation of Privilege Vulnerability
Summary
Improper link resolution before file access ('link following') in Service Fabric allows an authorized attacker to elevate privileges locally.
Severity
6 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-07-08 19:26 UTC
CWE
  • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
Impacted products
Vendor Product Version
Microsoft Service Fabric Affected: 1.0.0 , < 10.1 Cumulative Update 7.0 (custom)
    cpe:2.3:a:azure:service_fabric:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2025-07-08 07:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-21195",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-07-08T19:26:12.089085Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-08T19:54:21.588Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Service Fabric",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.1 Cumulative Update 7.0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:azure:service_fabric:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.1 Cumulative Update 7.0",
                  "versionStartIncluding": "1.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2025-07-08T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Improper link resolution before file access (\u0027link following\u0027) in Service Fabric allows an authorized attacker to elevate privileges locally."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-13T19:06:37.177Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure Service Fabric Runtime Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21195"
        }
      ],
      "title": "Azure Service Fabric Runtime Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2025-21195",
    "datePublished": "2025-07-08T16:57:01.559Z",
    "dateReserved": "2024-12-05T21:43:30.767Z",
    "dateUpdated": "2026-02-13T19:06:37.177Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21188 (GCVE-0-2025-21188)

Vulnerability from cvelistv5 – Published: 2025-02-11 17:58 – Updated: 2026-02-26 19:09
VLAI
Title
Azure Network Watcher VM Extension Elevation of Privilege Vulnerability
Summary
Azure Network Watcher VM Extension Elevation of Privilege Vulnerability
Severity
6 (Medium)
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-01 04:55 UTC
CWE
  • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
Impacted products
Vendor Product Version
Microsoft Azure Network Watcher VM Extension Affected: 1.0.0.0 , < 1.4.3563.1 (custom)
    cpe:2.3:a:microsoft:azure_network_watcher_agent:*:*:*:*:*:-:*:*
Create a notification for this product.
Date Public
2025-02-11 08:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-21188",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-01T04:55:34.286959Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T19:09:07.120Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Azure Network Watcher VM Extension",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "1.4.3563.1",
              "status": "affected",
              "version": "1.0.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:azure_network_watcher_agent:*:*:*:*:*:-:*:*",
                  "versionEndExcluding": "1.4.3563.1",
                  "versionStartIncluding": "1.0.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2025-02-11T08:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Azure Network Watcher VM Extension Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-13T19:44:10.920Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Azure Network Watcher VM Extension Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory",
            "patch"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21188"
        }
      ],
      "title": "Azure Network Watcher VM Extension Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2025-21188",
    "datePublished": "2025-02-11T17:58:06.563Z",
    "dateReserved": "2024-12-05T21:43:30.765Z",
    "dateUpdated": "2026-02-26T19:09:07.120Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-20003 (GCVE-0-2025-20003)

Vulnerability from cvelistv5 – Published: 2025-05-13 21:01 – Updated: 2026-02-26 18:28
VLAI
Summary
Improper link resolution before file access ('Link Following') for some Intel(R) Graphics Driver software installers may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity
8.2 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-05-15 04:02 UTC
CWE
  • Escalation of Privilege
  • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
Impacted products
Vendor Product Version
n/a Intel(R) Graphics Driver software installers Affected: See references
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-20003",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-15T04:02:13.470636Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-26T18:28:19.579Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Intel(R) Graphics Driver software installers",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "See references"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper link resolution before file access (\u0027Link Following\u0027) for some Intel(R) Graphics Driver software installers may allow an authenticated user to potentially enable escalation of privilege via local access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Escalation of Privilege",
              "lang": "en"
            },
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-13T21:01:26.302Z",
        "orgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
        "shortName": "intel"
      },
      "references": [
        {
          "name": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01259.html",
          "url": "https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01259.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6dda929c-bb53-4a77-a76d-48e79601a1ce",
    "assignerShortName": "intel",
    "cveId": "CVE-2025-20003",
    "datePublished": "2025-05-13T21:01:26.302Z",
    "dateReserved": "2024-10-13T03:00:13.103Z",
    "dateUpdated": "2026-02-26T18:28:19.579Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-15543 (GCVE-0-2025-15543)

Vulnerability from cvelistv5 – Published: 2026-01-29 18:06 – Updated: 2026-01-29 18:47
VLAI
Title
Read-Only Root Access via USB Storage Device in TP-Link VX800v
Summary
Improper link resolution in USB HTTP access path in VX800v v1.0 allows a crafted USB device to expose root filesystem contents, giving an attacker with physical access read‑only access to system files.
Severity
5.1 (Medium)
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-29 18:47 UTC
CWE
  • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
Impacted products
Vendor Product Version
TP-Link Systems Inc. VX800v v1.0 Affected: 0 , < 800.0.11 (0.11.0 3.0.0 v603c.0 Build 250702) (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-15543",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-29T18:47:08.484120Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-29T18:47:34.664Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "web"
          ],
          "platforms": [
            "Linux"
          ],
          "product": "VX800v v1.0",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "800.0.11 (0.11.0 3.0.0 v603c.0 Build 250702)",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper link resolution in USB HTTP access path in VX800v v1.0 allows a crafted USB device to expose root filesystem contents, giving an attacker with physical access read\u2011only access to system files."
            }
          ],
          "value": "Improper link resolution in USB HTTP access path in VX800v v1.0 allows a crafted USB device to expose root filesystem contents, giving an attacker with physical access read\u2011only access to system files."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-27",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-27 Leveraging Race Conditions via Symbolic Links"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "PHYSICAL",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-29T18:06:44.747Z",
        "orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "shortName": "TPLink"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/de/support/download/vx800v/#Firmware"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.tp-link.com/us/support/faq/4930/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Read-Only Root Access via USB Storage Device in TP-Link VX800v",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
    "assignerShortName": "TPLink",
    "cveId": "CVE-2025-15543",
    "datePublished": "2026-01-29T18:06:44.747Z",
    "dateReserved": "2026-01-20T21:50:45.777Z",
    "dateUpdated": "2026-01-29T18:47:34.664Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-15541 (GCVE-0-2025-15541)

Vulnerability from cvelistv5 – Published: 2026-01-29 18:05 – Updated: 2026-01-29 20:37
VLAI
Title
Access to System Files via SFTP on TP-Link VX800v
Summary
Improper link resolution in the VX800v v1.0 SFTP service allows authenticated adjacent attackers to use crafted symbolic links to access system files, resulting in high confidentiality impact and limited integrity risk.
Severity
6.9 (Medium)
CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-01-29 20:37 UTC
CWE
  • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
Impacted products
Vendor Product Version
TP-Link Systems Inc. VX800v v1.0 Affected: 0 , < 800.0.11 (0.11.0 3.0.0 v603c.0 Build 250702) (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-15541",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-29T20:37:03.731451Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-29T20:37:28.996Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "modules": [
            "web"
          ],
          "platforms": [
            "Linux"
          ],
          "product": "VX800v v1.0",
          "vendor": "TP-Link Systems Inc.",
          "versions": [
            {
              "lessThan": "800.0.11 (0.11.0 3.0.0 v603c.0 Build 250702)",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper link resolution in the VX800v v1.0 SFTP service allows authenticated adjacent attackers to use crafted symbolic links to access system files, resulting in high confidentiality impact and limited integrity risk."
            }
          ],
          "value": "Improper link resolution in the VX800v v1.0 SFTP service allows authenticated adjacent attackers to use crafted symbolic links to access system files, resulting in high confidentiality impact and limited integrity risk."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-27",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-27 Leveraging Race Conditions via Symbolic Links"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-29T18:05:57.407Z",
        "orgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
        "shortName": "TPLink"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://www.tp-link.com/de/support/download/vx800v/#Firmware"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.tp-link.com/us/support/faq/4930/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Access to System Files via SFTP on TP-Link VX800v",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f23511db-6c3e-4e32-a477-6aa17d310630",
    "assignerShortName": "TPLink",
    "cveId": "CVE-2025-15541",
    "datePublished": "2026-01-29T18:05:57.407Z",
    "dateReserved": "2026-01-20T21:50:41.239Z",
    "dateUpdated": "2026-01-29T20:37:28.996Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-15328 (GCVE-0-2025-15328)

Vulnerability from cvelistv5 – Published: 2026-02-05 18:24 – Updated: 2026-02-06 19:12
VLAI
Title
Tanium addressed an improper link resolution before file access vulnerability in Enforce.
Summary
Tanium addressed an improper link resolution before file access vulnerability in Enforce.
Severity
5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-06 19:12 UTC
CWE
  • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
Impacted products
Vendor Product Version
Tanium Enforce Affected: 2.7.0 , < 2.7.314 (custom)
Affected: 2.8.0 , < 2.8.544 (custom)
    cpe:2.3:a:tanium:service_enforce:2.7.313:*:*:*:*:*:*:*
    cpe:2.3:a:tanium:service_enforce:2.8.543:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2025-02-21 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-15328",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-06T19:12:46.298503Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-06T19:12:54.357Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:tanium:service_enforce:2.7.313:*:*:*:*:*:*:*",
            "cpe:2.3:a:tanium:service_enforce:2.8.543:*:*:*:*:*:*:*"
          ],
          "product": "Enforce",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "2.7.314",
              "status": "affected",
              "version": "2.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "2.8.544",
              "status": "affected",
              "version": "2.8.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-29T23:13:30.169Z",
      "datePublic": "2025-02-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Tanium addressed an improper link resolution before file access vulnerability in Enforce."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-05T18:24:42.534Z",
        "orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
        "shortName": "Tanium"
      },
      "references": [
        {
          "name": "TAN-2025-007",
          "url": "https://security.tanium.com/TAN-2025-007"
        }
      ],
      "title": "Tanium addressed an improper link resolution before file access vulnerability in Enforce."
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
    "assignerShortName": "Tanium",
    "cveId": "CVE-2025-15328",
    "datePublished": "2026-02-05T18:24:42.534Z",
    "dateReserved": "2025-12-29T23:13:30.399Z",
    "dateUpdated": "2026-02-06T19:12:54.357Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-15324 (GCVE-0-2025-15324)

Vulnerability from cvelistv5 – Published: 2026-02-05 18:25 – Updated: 2026-02-06 19:03
VLAI
Title
Tanium addressed a local privilege escalation vulnerability in Engage.
Summary
Tanium addressed a documentation issue in Engage.
Severity
6.6 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-06 19:03 UTC
CWE
  • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
Impacted products
Vendor Product Version
Tanium Engage Affected: 1.3.0 , < 1.3.37 (custom)
Affected: 1.6.0 , < 1.6.193 (custom)
    cpe:2.3:a:tanium:service_engage:1.3.36:*:*:*:*:*:*:*
    cpe:2.3:a:tanium:service_engage:1.6.192:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2025-01-22 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-15324",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-06T19:03:35.009129Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-06T19:03:42.971Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:tanium:service_engage:1.3.36:*:*:*:*:*:*:*",
            "cpe:2.3:a:tanium:service_engage:1.6.192:*:*:*:*:*:*:*"
          ],
          "product": "Engage",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "1.3.37",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.6.193",
              "status": "affected",
              "version": "1.6.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-29T23:13:03.546Z",
      "datePublic": "2025-01-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Tanium addressed a documentation issue in Engage."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-05T18:25:52.474Z",
        "orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
        "shortName": "Tanium"
      },
      "references": [
        {
          "name": "TAN-2025-004",
          "url": "https://security.tanium.com/TAN-2025-004"
        }
      ],
      "title": "Tanium addressed a local privilege escalation vulnerability in Engage."
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
    "assignerShortName": "Tanium",
    "cveId": "CVE-2025-15324",
    "datePublished": "2026-02-05T18:25:52.474Z",
    "dateReserved": "2025-12-29T23:13:03.776Z",
    "dateUpdated": "2026-02-06T19:03:42.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-15319 (GCVE-0-2025-15319)

Vulnerability from cvelistv5 – Published: 2026-02-09 22:52 – Updated: 2026-02-10 21:21
VLAI
Title
Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.
Summary
Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-10 21:21 UTC
CWE
  • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
Impacted products
Vendor Product Version
Tanium Patch Endpoint Tools Affected: 3.17.0 , < 3.17.10207 (custom)
Affected: 10.1.0 , < 10.1.50 (custom)
Affected: 10.7.0 , < 10.7.25 (custom)
Affected: 10.9.0 , < 10.9.31 (custom)
Affected: 10.11.0 , < 10.11.27 (custom)
    cpe:2.3:a:tanium:endpoint_patch:3.17.10206:*:*:*:*:*:*:*
    cpe:2.3:a:tanium:endpoint_patch:10.1.49:*:*:*:*:*:*:*
    cpe:2.3:a:tanium:endpoint_patch:10.7.24:*:*:*:*:*:*:*
    cpe:2.3:a:tanium:endpoint_patch:10.9.30:*:*:*:*:*:*:*
    cpe:2.3:a:tanium:endpoint_patch:10.10.26:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2025-08-07 00:00
Credits
Owen Jeanes
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-15319",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-10T21:21:32.326259Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-10T21:21:40.851Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:tanium:endpoint_patch:3.17.10206:*:*:*:*:*:*:*",
            "cpe:2.3:a:tanium:endpoint_patch:10.1.49:*:*:*:*:*:*:*",
            "cpe:2.3:a:tanium:endpoint_patch:10.7.24:*:*:*:*:*:*:*",
            "cpe:2.3:a:tanium:endpoint_patch:10.9.30:*:*:*:*:*:*:*",
            "cpe:2.3:a:tanium:endpoint_patch:10.10.26:*:*:*:*:*:*:*"
          ],
          "product": "Patch Endpoint Tools",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "3.17.10207",
              "status": "affected",
              "version": "3.17.0",
              "versionType": "custom"
            },
            {
              "lessThan": "10.1.50",
              "status": "affected",
              "version": "10.1.0",
              "versionType": "custom"
            },
            {
              "lessThan": "10.7.25",
              "status": "affected",
              "version": "10.7.0",
              "versionType": "custom"
            },
            {
              "lessThan": "10.9.31",
              "status": "affected",
              "version": "10.9.0",
              "versionType": "custom"
            },
            {
              "lessThan": "10.11.27",
              "status": "affected",
              "version": "10.11.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Owen Jeanes"
        }
      ],
      "dateAssigned": "2025-12-29T23:12:58.700Z",
      "datePublic": "2025-08-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-09T23:09:49.225Z",
        "orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
        "shortName": "Tanium"
      },
      "references": [
        {
          "name": "TAN-2025-021",
          "url": "https://security.tanium.com/TAN-2025-021"
        }
      ],
      "title": "Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools."
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
    "assignerShortName": "Tanium",
    "cveId": "CVE-2025-15319",
    "datePublished": "2026-02-09T22:52:32.693Z",
    "dateReserved": "2025-12-29T23:12:58.866Z",
    "dateUpdated": "2026-02-10T21:21:40.851Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-15318 (GCVE-0-2025-15318)

Vulnerability from cvelistv5 – Published: 2026-02-09 22:56 – Updated: 2026-02-10 21:22
VLAI
Title
Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools.
Summary
Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools.
Severity
5.1 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-10 21:21 UTC
CWE
  • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
Impacted products
Vendor Product Version
Tanium End-User Notifications Endpoint Tools Affected: 1.18.0 , < 1.18.10079 (custom)
Affected: 10.0.0 , < 10.0.14 (custom)
Affected: 10.1.0 , < 10.1.20 (custom)
    cpe:2.3:a:tanium:endpoint_end-user-notifications:1.18.10078:*:*:*:*:*:*:*
    cpe:2.3:a:tanium:endpoint_end-user-notifications:10.0.13:*:*:*:*:*:*:*
    cpe:2.3:a:tanium:endpoint_end-user-notifications:10.1.19:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2025-05-07 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-15318",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-10T21:21:53.649467Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-10T21:22:00.345Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:tanium:endpoint_end-user-notifications:1.18.10078:*:*:*:*:*:*:*",
            "cpe:2.3:a:tanium:endpoint_end-user-notifications:10.0.13:*:*:*:*:*:*:*",
            "cpe:2.3:a:tanium:endpoint_end-user-notifications:10.1.19:*:*:*:*:*:*:*"
          ],
          "product": "End-User Notifications Endpoint Tools",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "1.18.10079",
              "status": "affected",
              "version": "1.18.0",
              "versionType": "custom"
            },
            {
              "lessThan": "10.0.14",
              "status": "affected",
              "version": "10.0.0",
              "versionType": "custom"
            },
            {
              "lessThan": "10.1.20",
              "status": "affected",
              "version": "10.1.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-29T23:12:57.784Z",
      "datePublic": "2025-05-07T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-09T23:11:46.729Z",
        "orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
        "shortName": "Tanium"
      },
      "references": [
        {
          "name": "TAN-2025-017",
          "url": "https://security.tanium.com/TAN-2025-017"
        }
      ],
      "title": "Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools."
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
    "assignerShortName": "Tanium",
    "cveId": "CVE-2025-15318",
    "datePublished": "2026-02-09T22:56:27.343Z",
    "dateReserved": "2025-12-29T23:12:57.929Z",
    "dateUpdated": "2026-02-10T21:22:00.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-15314 (GCVE-0-2025-15314)

Vulnerability from cvelistv5 – Published: 2026-02-09 23:05 – Updated: 2026-02-10 20:18
VLAI
Title
Tanium addressed an arbitrary file deletion vulnerability in end-user-cx.
Summary
Tanium addressed an arbitrary file deletion vulnerability in end-user-cx.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-02-10 20:18 UTC
CWE
  • CWE-59 - Improper Link Resolution Before File Access ('Link Following')
Assigner
References
Impacted products
Vendor Product Version
Tanium end-user-cx Affected: 1.4.0 , < 1.4.1175 (custom)
Affected: 1.6.0 , < 1.6.926 (custom)
Affected: 1.8.0 , < 1.8.21 (custom)
    cpe:2.3:a:tanium:endpoint_end-user-cx:1.4.1174:*:*:*:*:*:*:*
    cpe:2.3:a:tanium:endpoint_end-user-cx:1.6.925:*:*:*:*:*:*:*
    cpe:2.3:a:tanium:endpoint_end-user-cx:1.8.20:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2025-02-21 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-15314",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-10T20:18:17.474330Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-10T20:18:24.846Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:tanium:endpoint_end-user-cx:1.4.1174:*:*:*:*:*:*:*",
            "cpe:2.3:a:tanium:endpoint_end-user-cx:1.6.925:*:*:*:*:*:*:*",
            "cpe:2.3:a:tanium:endpoint_end-user-cx:1.8.20:*:*:*:*:*:*:*"
          ],
          "product": "end-user-cx",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "1.4.1175",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.6.926",
              "status": "affected",
              "version": "1.6.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.8.21",
              "status": "affected",
              "version": "1.8.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "dateAssigned": "2025-12-29T23:12:54.705Z",
      "datePublic": "2025-02-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Tanium addressed an arbitrary file deletion vulnerability in end-user-cx."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-09T23:06:46.478Z",
        "orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
        "shortName": "Tanium"
      },
      "references": [
        {
          "name": "TAN-2025-010",
          "url": "https://security.tanium.com/TAN-2025-010"
        }
      ],
      "title": "Tanium addressed an arbitrary file deletion vulnerability in end-user-cx."
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
    "assignerShortName": "Tanium",
    "cveId": "CVE-2025-15314",
    "datePublished": "2026-02-09T23:05:16.503Z",
    "dateReserved": "2025-12-29T23:12:54.874Z",
    "dateUpdated": "2026-02-10T20:18:24.846Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation MIT-48.1
Architecture and Design

Strategy: Separation of Privilege

  • Follow the principle of least privilege when assigning access rights to entities in a software system.
  • Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack

An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.

CAPEC-17: Using Malicious Files

An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.

CAPEC-35: Leverage Executable Code in Non-Executable Files

An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.

CAPEC-76: Manipulating Web Input to File System Calls

An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.

← Back to the CWE list