CWE-59

{
  "affected": [],
  "aliases": [
    "CVE-2022-21770"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-07-06T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "In sound driver, there is a possible information disclosure due to symlink following. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06558663; Issue ID: ALPS06558663.",
  "id": "GHSA-599w-rmp9-p3vv",
  "modified": "2022-07-15T00:00:23Z",
  "published": "2022-07-07T00:00:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21770"
    },
    {
      "type": "WEB",
      "url": "https://corp.mediatek.com/product-security-bulletin/July-2022"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-12341"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-28T01:16:11Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability was detected in ermig1979 AntiDupl up to 2.3.12. Impacted is an unknown function of the file AntiDupl.NET.WinForms.exe of the component Delete Duplicate Image Handler. The manipulation results in link following. The attack is only possible with local access. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-59pm-697w-v8v8",
  "modified": "2025-10-28T03:30:19Z",
  "published": "2025-10-28T03:30:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12341"
    },
    {
      "type": "WEB",
      "url": "https://drive.google.com/file/d/19jwaqUji6O3U6EAeUMixBM58QTc4qNMQ/view?usp=sharing"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.330127"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.330127"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.674515"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-30457"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-31T23:15:27Z",
    "severity": "CRITICAL"
  },
  "details": "This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. A malicious app may be able to create symlinks to protected regions of the disk.",
  "id": "GHSA-59wj-h89p-37x9",
  "modified": "2025-11-04T00:32:24Z",
  "published": "2025-04-01T00:30:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30457"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/122373"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/122374"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/en-us/122375"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2025/Apr/10"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2025/Apr/8"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2025/Apr/9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2015-1377"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2015-02-10T20:59:00Z",
    "severity": "MODERATE"
  },
  "details": "The Read Mail module in Webmin 1.720 allows local users to read arbitrary files via a symlink attack on an unspecified file.",
  "id": "GHSA-5c52-j627-9mh6",
  "modified": "2022-05-17T04:16:05Z",
  "published": "2022-05-17T04:16:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1377"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/62157"
    },
    {
      "type": "WEB",
      "url": "http://www.webmin.com/changes.html"
    },
    {
      "type": "WEB",
      "url": "http://www.webmin.com/security.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-14891"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-08T20:16:48Z",
    "severity": "HIGH"
  },
  "details": "HashiCorp Nomad and Nomad Enterprise are vulnerable to a sandbox escape in the Docker task driver that may allow a job submitter to bind-mount a host path into a container even when volume bind mounts are disabled, potentially leading to reading and writing files on the host. This vulnerability, CVE-2026-14891, is fixed in Nomad Community Edition 2.0.4 and Nomad Enterprise 2.0.4, 1.11.8, and 1.10.14.",
  "id": "GHSA-5c56-jfhx-4gcm",
  "modified": "2026-07-08T21:30:27Z",
  "published": "2026-07-08T21:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14891"
    },
    {
      "type": "WEB",
      "url": "https://discuss.hashicorp.com/t/hcsec-2026-21-nomad-vulnerable-to-sandbox-escape-in-docker-task-driver/77561"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2014-3537"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-07-23T14:55:00Z",
    "severity": "LOW"
  },
  "details": "The web interface in CUPS before 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/.",
  "id": "GHSA-5cfv-xhm7-9f3x",
  "modified": "2022-05-17T03:06:07Z",
  "published": "2022-05-17T03:06:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3537"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHBA-2015:0386"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2014:1388"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2014-3537"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1115576"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT6535"
    },
    {
      "type": "WEB",
      "url": "http://advisories.mageia.org/MGASA-2014-0313.html"
    },
    {
      "type": "WEB",
      "url": "http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-July/135528.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2014-1388.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/59945"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60273"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/60787"
    },
    {
      "type": "WEB",
      "url": "http://www.cups.org/blog.php?L724"
    },
    {
      "type": "WEB",
      "url": "http://www.cups.org/str.php?L4450"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2015:108"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/68788"
    },
    {
      "type": "WEB",
      "url": "http://www.securitytracker.com/id/1030611"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-2293-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-0572"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-01-08T21:29:00Z",
    "severity": "HIGH"
  },
  "details": "An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka \"Windows Data Sharing Service Elevation of Privilege Vulnerability.\" This affects Windows Server 2016, Windows 10, Windows Server 2019, Windows 10 Servers. This CVE ID is unique from CVE-2019-0571, CVE-2019-0573, CVE-2019-0574.",
  "id": "GHSA-5cm5-ww33-gf65",
  "modified": "2022-05-13T01:21:18Z",
  "published": "2022-05-13T01:21:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-0572"
    },
    {
      "type": "WEB",
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0572"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/46157"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/106428"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.2.7"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "dulwich"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.23.1"
            },
            {
              "fixed": "1.2.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-59"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-02T18:53:05Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nDulwich\u0027s `filter_branch.py` `CommitFilter._apply_index_filter()` is vulnerable to symlink directory traversal. When processing commit history, materialized tree entries (including symlinks) persist in the working directory between commits, allowing a symlink from an ancestor commit to redirect file writes from a descendant commit to arbitrary filesystem locations.\n\n## Root Cause\n\n`_apply_index_filter()` at `dulwich/filter_branch.py:212` calls `build_index_from_tree(\".\", tmp_index_path, ...)` which materializes all tree entries to the current working directory. The `finally` block (line 229-230) only cleans up the temporary index file (`os.unlink(tmp_index_path)`) \u2014 NOT the filesystem files written to CWD. When `process_commit()` processes parents recursively first (line 260), files materialized from ancestor commits persist and affect processing of descendant commits.\n\nOn dulwich 1.2.7, `build_file_from_blob()` has no symlink protection, and `validate_path_element` only validates name patterns, not filesystem state.\n\n## Impact\n\nAn attacker can craft a malicious repository where running `filter_branch` with an index filter writes attacker-controlled content to arbitrary filesystem locations via symlink traversal. This achieves RCE if the write targets `.git/hooks/`.\n\n## Attack Scenario\n\n1. Attacker creates a repository where commit history (linearized) has:\n   - Ancestor commit: tree entry `evil` (mode 120000, symlink \u2192 `/target_dir`)\n   - Descendant commit: tree entry `evil/payload` (mode 100644, attacker content)\n2. Victim clones repository and runs `filter_branch` with an index filter\n3. `process_commit()` processes ancestor first \u2192 materializes `evil` as symlink to `/target_dir` in CWD\n4. CWD is NOT cleaned between commits\n5. Processing descendant: `os.path.exists(\"./evil\")` \u2192 True (symlink exists). `build_file_from_blob(blob, mode, \"./evil/payload\")` \u2192 `open(\"./evil/payload\", \"wb\")` follows intermediate symlink \u2192 writes to `/target_dir/payload`\n\n## Suggested Fix\n\nClean the CWD between commit iterations in `_apply_index_filter()`, or verify that no intermediate path components are symlinks before writing files.\n\nReported by **zx (Jace)**",
  "id": "GHSA-5fqc-mrg8-w798",
  "modified": "2026-10-02T18:53:05Z",
  "published": "2026-10-02T18:53:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jelmer/dulwich/security/advisories/GHSA-5fqc-mrg8-w798"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jelmer/dulwich/commit/9571ac60b851fce228dae7ededb380c6ce9b3fb8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jelmer/dulwich"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jelmer/dulwich/releases/tag/dulwich-1.2.8"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-63945"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-02-23T20:28:52Z",
    "severity": "HIGH"
  },
  "details": "A privilege escalation (PE) vulnerability in the Tencent iOA app thru 210.9.28693.621001 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race condition.",
  "id": "GHSA-5fqg-ph33-v8fc",
  "modified": "2026-02-23T21:31:27Z",
  "published": "2026-02-23T21:31:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-63945"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alexlee820/CVE-2025-63945-Tencent-iOA-EoP"
    },
    {
      "type": "WEB",
      "url": "https://github.com/alexlee820/Tencent-iOA-EoP"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2009-1962"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2009-06-08T01:00:00Z",
    "severity": "MODERATE"
  },
  "details": "Xfig, possibly 3.2.5, allows local users to read and write arbitrary files via a symlink attack on the (1) xfig-eps[PID], (2) xfig-pic[PID].pix, (3) xfig-pic[PID].err, (4) xfig-pcx[PID].pix, (5) xfig-xfigrc[PID], (6) xfig[PID], (7) xfig-print[PID], (8) xfig-export[PID].err, (9) xfig-batch[PID], (10) xfig-exp[PID], or (11) xfig-spell.[PID] temporary files, where [PID] is a process ID.",
  "id": "GHSA-5fvh-wp4h-m832",
  "modified": "2022-05-02T03:30:20Z",
  "published": "2022-05-02T03:30:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1962"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/49600"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/35320"
    },
    {
      "type": "WEB",
      "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:244"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2009/04/01/6"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/34328"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}