CWE-59
AllowedImproper Link Resolution Before File Access ('Link Following')
Abstraction: Base · Status: Draft
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
1987 vulnerabilities reference this CWE, most recent first.
GHSA-78GC-JMVW-X2MX
Vulnerability from github – Published: 2022-05-17 02:02 – Updated: 2025-04-11 03:45The Debian GNU/Linux /etc/cron.d/php5 cron job for PHP 5.3.5 allows local users to delete arbitrary files via a symlink attack on a directory under /var/lib/php5/.
{
"affected": [],
"aliases": [
"CVE-2011-0441"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-03-29T18:55:00Z",
"severity": "MODERATE"
},
"details": "The Debian GNU/Linux /etc/cron.d/php5 cron job for PHP 5.3.5 allows local users to delete arbitrary files via a symlink attack on a directory under /var/lib/php5/.",
"id": "GHSA-78gc-jmvw-x2mx",
"modified": "2025-04-11T03:45:42Z",
"published": "2022-05-17T02:02:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0441"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66180"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618489"
},
{
"type": "WEB",
"url": "http://git.debian.org/?p=pkg-php/php.git%3Ba=commit%3Bh=d09fd04ed7bfcf7f008360c6a42025108925df09"
},
{
"type": "WEB",
"url": "http://git.debian.org/?p=pkg-php/php.git;a=commit;h=d09fd04ed7bfcf7f008360c6a42025108925df09"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:069"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/46928"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2011/0910"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-78QG-Q6HH-66C3
Vulnerability from github – Published: 2022-05-17 03:16 – Updated: 2022-05-17 03:16Backup in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via a crafted app that creates a symlink.
{
"affected": [],
"aliases": [
"CVE-2015-5752"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-08-17T00:00:00Z",
"severity": "MODERATE"
},
"details": "Backup in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via a crafted app that creates a symlink.",
"id": "GHSA-78qg-q6hh-66c3",
"modified": "2022-05-17T03:16:23Z",
"published": "2022-05-17T03:16:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5752"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT205030"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/76337"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1033275"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-796P-JV3P-9CM6
Vulnerability from github – Published: 2022-04-29 01:28 – Updated: 2022-04-29 01:28nsr_shutdown in Fujitsu Siemens NetWorker 6.0 allows local users to overwrite arbitrary files via a symlink attack on the nsrsh[PID] temporary file.
{
"affected": [],
"aliases": [
"CVE-2003-1528"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2003-12-31T05:00:00Z",
"severity": "HIGH"
},
"details": "nsr_shutdown in Fujitsu Siemens NetWorker 6.0 allows local users to overwrite arbitrary files via a symlink attack on the nsrsh[PID] temporary file.",
"id": "GHSA-796p-jv3p-9cm6",
"modified": "2022-04-29T01:28:13Z",
"published": "2022-04-29T01:28:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-1528"
},
{
"type": "WEB",
"url": "http://securityreason.com/securityalert/3353"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/350237/30/21640/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/9446"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1008801"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-79PV-JCHP-Q27M
Vulnerability from github – Published: 2022-05-14 02:47 – Updated: 2025-04-20 03:38AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. NOTE: This vulnerability exists due to an incomplete fix for CVE-2015-7723.
{
"affected": [],
"aliases": [
"CVE-2015-7724"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-07T14:29:00Z",
"severity": "HIGH"
},
"details": "AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. NOTE: This vulnerability exists due to an incomplete fix for CVE-2015-7723.",
"id": "GHSA-79pv-jchp-q27m",
"modified": "2025-04-20T03:38:35Z",
"published": "2022-05-14T02:47:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7724"
},
{
"type": "WEB",
"url": "https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-7724"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/134120/AMD-fglrx-driver-15.7-Privilege-Escalation.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2015/Oct/103"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/536782/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/77361"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7C44-7J7V-W554
Vulnerability from github – Published: 2023-12-22 12:31 – Updated: 2024-01-03 21:45A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/buildkite/elastic-ci-stack-for-aws/v6"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-43116"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-03T21:45:42Z",
"nvd_published_at": "2023-12-22T10:15:11Z",
"severity": "HIGH"
},
"details": "A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script.",
"id": "GHSA-7c44-7j7v-w554",
"modified": "2024-01-03T21:45:42Z",
"published": "2023-12-22T12:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43116"
},
{
"type": "WEB",
"url": "https://github.com/buildkite/elastic-ci-stack-for-aws/commit/8f79882b6aa18fb8fc61f10c7047d2907b7a2f69"
},
{
"type": "WEB",
"url": "https://github.com/atredispartners/advisories/blob/master/ATREDIS-2023-0003.md"
},
{
"type": "PACKAGE",
"url": "https://github.com/buildkite/elastic-ci-stack-for-aws"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Buildkite Elastic CI for AWS symbolic link following vulnerability"
}
GHSA-7C58-VXQ5-5V66
Vulnerability from github – Published: 2022-05-14 02:47 – Updated: 2025-04-20 03:38AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack.
{
"affected": [],
"aliases": [
"CVE-2015-7723"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-07T14:29:00Z",
"severity": "HIGH"
},
"details": "AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack.",
"id": "GHSA-7c58-vxq5-5v66",
"modified": "2025-04-20T03:38:35Z",
"published": "2022-05-14T02:47:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7723"
},
{
"type": "WEB",
"url": "https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-7723"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/134121/AMD-fglrx-driver-14.4.2-Privilege-Escalation.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2015/Oct/104"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/536783/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/77357"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7CPF-464X-JV68
Vulnerability from github – Published: 2022-05-24 16:45 – Updated: 2024-04-04 00:41Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access.
{
"affected": [],
"aliases": [
"CVE-2019-0086"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-05-17T16:29:00Z",
"severity": "HIGH"
},
"details": "Insufficient access control vulnerability in Dynamic Application Loader software for Intel(R) CSME before versions 11.8.65, 11.11.65, 11.22.65, 12.0.35 and Intel(R) TXE 3.1.65, 4.0.15 may allow an unprivileged user to potentially enable escalation of privilege via local access.",
"id": "GHSA-7cpf-464x-jv68",
"modified": "2024-04-04T00:41:37Z",
"published": "2022-05-24T16:45:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0086"
},
{
"type": "WEB",
"url": "https://danishcyberdefence.dk/blog/dal"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K35815741"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7CQH-9WJJ-HHF9
Vulnerability from github – Published: 2022-05-01 23:42 – Updated: 2025-04-09 03:53vcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to overwrite arbitrary files via a symlink attack on temporary files.
{
"affected": [],
"aliases": [
"CVE-2008-1694"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-04-22T04:41:00Z",
"severity": "MODERATE"
},
"details": "vcdiff in Emacs 20.7 to 22.1.50, when used with SCCS, allows local users to overwrite arbitrary files via a symlink attack on temporary files.",
"id": "GHSA-7cqh-9wjj-hhf9",
"modified": "2025-04-09T03:53:52Z",
"published": "2022-05-01T23:42:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-1694"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=208483"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41906"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/607-1"
},
{
"type": "WEB",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=216880"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/29905"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/29926"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/30109"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2008:096"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/28857"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1019909"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/1309/references"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2008/1310/references"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7CR3-H577-G38J
Vulnerability from github – Published: 2026-07-06 20:15 – Updated: 2026-07-06 20:15The --preserve-root check uses a path-string test (path.has_root() && path.parent().is_none()) rather than comparing device/inode. A symlink to / (e.g. /tmp/rootlink -> /) has a parent component, so it passes the check. GNU caches /'s dev/inode at startup and compares every traversed directory against it.
Impact: rm -rf --preserve-root on a path that resolves through a symlink to / bypasses protection and can delete system directories. Recommendation: compare each entered directory's dev/inode against cached /.
Remediation: Acknowledged by Canonical; fixed in commit 5e5968cd.
Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.44. Credit: Zellic.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "uu_rm"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-35349"
],
"database_specific": {
"cwe_ids": [
"CWE-59",
"CWE-693"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-06T20:15:27Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "The `--preserve-root` check uses a path-string test (`path.has_root() \u0026\u0026 path.parent().is_none()`) rather than comparing device/inode. A symlink to `/` (e.g. `/tmp/rootlink -\u003e /`) has a parent component, so it passes the check. GNU caches `/`\u0027s dev/inode at startup and compares every traversed directory against it.\n\n**Impact:** `rm -rf --preserve-root` on a path that resolves through a symlink to `/` bypasses protection and can delete system directories. Recommendation: compare each entered directory\u0027s dev/inode against cached `/`.\n\n**Remediation:** Acknowledged by Canonical; fixed in commit 5e5968cd.\n\n---\n_Reported by Zellic in the *uutils coreutils Program Security Assessment* (prepared for Canonical, Jan 20 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`. Finding 3.44. Credit: Zellic._",
"id": "GHSA-7cr3-h577-g38j",
"modified": "2026-07-06T20:15:27Z",
"published": "2026-07-06T20:15:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/security/advisories/GHSA-7cr3-h577-g38j"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35349"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/pull/9706"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/commit/5e5968cdbc6618acd6c2402a8a98b503f278835e"
},
{
"type": "PACKAGE",
"url": "https://github.com/uutils/coreutils"
},
{
"type": "WEB",
"url": "https://github.com/uutils/coreutils/releases/tag/0.7.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "rm: --preserve-root bypassed via a symlink to / (string check instead of dev/inode)"
}
GHSA-7CRM-H967-F3PF
Vulnerability from github – Published: 2022-06-29 00:00 – Updated: 2022-07-09 00:00Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files.
{
"affected": [],
"aliases": [
"CVE-2022-2145"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-28T18:15:00Z",
"severity": "HIGH"
},
"details": "Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files.",
"id": "GHSA-7crm-h967-f3pf",
"modified": "2022-07-09T00:00:25Z",
"published": "2022-06-29T00:00:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/cloudflare/advisories/security/advisories/GHSA-6fpc-qxmr-6wrq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2145"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-48.1
Strategy: Separation of Privilege
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack
An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.