CWE-59
AllowedImproper Link Resolution Before File Access ('Link Following')
Abstraction: Base · Status: Draft
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
1992 vulnerabilities reference this CWE, most recent first.
GHSA-JRGV-PMF9-6QG5
Vulnerability from github – Published: 2025-04-01 00:30 – Updated: 2025-11-04 00:32This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access protected user data.
{
"affected": [],
"aliases": [
"CVE-2025-24278"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-31T23:15:24Z",
"severity": "CRITICAL"
},
"details": "This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access protected user data.",
"id": "GHSA-jrgv-pmf9-6qg5",
"modified": "2025-11-04T00:32:22Z",
"published": "2025-04-01T00:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24278"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122373"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122374"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122375"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Apr/10"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Apr/8"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Apr/9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JV9Q-V37Q-34VV
Vulnerability from github – Published: 2022-05-13 01:04 – Updated: 2022-05-13 01:04The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/.
{
"affected": [],
"aliases": [
"CVE-2012-0871"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-04-18T14:55:00Z",
"severity": "MODERATE"
},
"details": "The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/.",
"id": "GHSA-jv9q-v37q-34vv",
"modified": "2022-05-13T01:04:14Z",
"published": "2022-05-13T01:04:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0871"
},
{
"type": "WEB",
"url": "https://bugzilla.novell.com/show_bug.cgi?id=747154"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=795853"
},
{
"type": "WEB",
"url": "http://cgit.freedesktop.org/systemd/systemd/commit/?id=fc3c1c6e091ea16ad5600b145201ec535bbb5d7c"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00030.html"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/79768"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JVMP-6X88-C46P
Vulnerability from github – Published: 2022-05-14 02:12 – Updated: 2022-05-14 02:12An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the "libarchive" component, which allows local users to write to arbitrary files via vectors related to symlinks.
{
"affected": [],
"aliases": [
"CVE-2016-7619"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-02-20T08:59:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the \"libarchive\" component, which allows local users to write to arbitrary files via vectors related to symlinks.",
"id": "GHSA-jvmp-6x88-c46p",
"modified": "2022-05-14T02:12:45Z",
"published": "2022-05-14T02:12:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7619"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT207422"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT207423"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT207487"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/94905"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1037469"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JW54-C8RR-PJPQ
Vulnerability from github – Published: 2025-06-11 18:35 – Updated: 2025-06-11 18:35os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.
{
"affected": [],
"aliases": [
"CVE-2025-0913"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-11T18:15:24Z",
"severity": "MODERATE"
},
"details": "os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.",
"id": "GHSA-jw54-c8rr-pjpq",
"modified": "2025-06-11T18:35:43Z",
"published": "2025-06-11T18:35:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0913"
},
{
"type": "WEB",
"url": "https://go.dev/cl/672396"
},
{
"type": "WEB",
"url": "https://go.dev/issue/73702"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2025-3750"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JW56-55H4-JXHW
Vulnerability from github – Published: 2022-05-13 01:28 – Updated: 2022-05-13 01:28The feh_unique_filename function in utils.c in feh before 1.11.2 might allow local users to overwrite arbitrary files via a symlink attack on a /tmp/feh_ temporary file.
{
"affected": [],
"aliases": [
"CVE-2011-0702"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-02-14T21:00:00Z",
"severity": "LOW"
},
"details": "The feh_unique_filename function in utils.c in feh before 1.11.2 might allow local users to overwrite arbitrary files via a symlink attack on a /tmp/feh_ temporary file.",
"id": "GHSA-jw56-55h4-jxhw",
"modified": "2022-05-13T01:28:02Z",
"published": "2022-05-13T01:28:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0702"
},
{
"type": "WEB",
"url": "https://github.com/derf/feh/issues/#issue/32"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ubuntu/+source/feh/+bug/607328"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=676389"
},
{
"type": "WEB",
"url": "https://derf.homelinux.org/git/feh/commit/?id=23421a86cc826dd30f3dc4f62057fafb04b3ac40"
},
{
"type": "WEB",
"url": "https://derf.homelinux.org/git/feh/commit/?id=29ab0855f044ef2fe9c295b72abefcb37f0861a5"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=612035"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2011/02/09/1"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2011/02/09/14"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/43221"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JWHF-G3HG-W2GV
Vulnerability from github – Published: 2022-05-17 05:19 – Updated: 2022-05-17 05:19sendbug in freebsd-sendpr 3.113+5.3 on Debian GNU/Linux allows local users to overwrite arbitrary files via a symlink attack on a /tmp/pr.##### temporary file.
{
"affected": [],
"aliases": [
"CVE-2008-5142"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-11-18T16:00:00Z",
"severity": "MODERATE"
},
"details": "sendbug in freebsd-sendpr 3.113+5.3 on Debian GNU/Linux allows local users to overwrite arbitrary files via a symlink attack on a /tmp/pr.##### temporary file.",
"id": "GHSA-jwhf-g3hg-w2gv",
"modified": "2022-05-17T05:19:33Z",
"published": "2022-05-17T05:19:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-5142"
},
{
"type": "WEB",
"url": "http://lists.debian.org/debian-devel/2008/08/msg00285.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/32381"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JWP9-9V96-94MX
Vulnerability from github – Published: 2026-07-10 00:31 – Updated: 2026-07-10 18:32decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content. Hardlinks are limited to files on the same filesystem and cannot target directories.
{
"affected": [],
"aliases": [
"CVE-2026-39243"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-09T22:17:04Z",
"severity": "MODERATE"
},
"details": "decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === \u0027link\u0027), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file\u0027s content. Hardlinks are limited to files on the same filesystem and cannot target directories.",
"id": "GHSA-jwp9-9v96-94mx",
"modified": "2026-07-10T18:32:08Z",
"published": "2026-07-10T00:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39243"
},
{
"type": "WEB",
"url": "https://github.com/kevva/decompress/issues/113"
},
{
"type": "WEB",
"url": "https://github.com/kevva/decompress"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/decompress"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JX33-88WC-7X75
Vulnerability from github – Published: 2021-12-17 00:00 – Updated: 2021-12-21 00:00A link following denial-of-service (DoS) vulnerability in the Trend Micro Security (Consumer) 2021 familiy of products could allow an attacker to abuse the PC Health Checkup feature of the product to create symlinks that would allow modification of files which could lead to a denial-of-service.
{
"affected": [],
"aliases": [
"CVE-2021-44023"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-16T03:15:00Z",
"severity": "HIGH"
},
"details": "A link following denial-of-service (DoS) vulnerability in the Trend Micro Security (Consumer) 2021 familiy of products could allow an attacker to abuse the PC Health Checkup feature of the product to create symlinks that would allow modification of files which could lead to a denial-of-service.",
"id": "GHSA-jx33-88wc-7x75",
"modified": "2021-12-21T00:00:54Z",
"published": "2021-12-17T00:00:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44023"
},
{
"type": "WEB",
"url": "https://helpcenter.trendmicro.com/en-us/article/tmka-10867"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1536"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JX3F-M8G8-PQMW
Vulnerability from github – Published: 2022-05-24 22:01 – Updated: 2024-04-04 03:08Symlink Traversal vulnerability in Belkin N900 due to misconfiguration in the SMB service.
{
"affected": [],
"aliases": [
"CVE-2013-4655"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-11-13T16:15:00Z",
"severity": "HIGH"
},
"details": "Symlink Traversal vulnerability in Belkin N900 due to misconfiguration in the SMB service.",
"id": "GHSA-jx3f-m8g8-pqmw",
"modified": "2024-04-04T03:08:44Z",
"published": "2022-05-24T22:01:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4655"
},
{
"type": "WEB",
"url": "https://www.ise.io/casestudies/exploiting-soho-routers"
},
{
"type": "WEB",
"url": "https://www.ise.io/soho_service_hacks"
},
{
"type": "WEB",
"url": "https://www.ise.io/wp-content/uploads/2017/07/soho_techreport.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JX3W-XGXJ-7C49
Vulnerability from github – Published: 2024-11-23 03:31 – Updated: 2024-11-23 03:31VIPRE Advanced Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the Anti Malware Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22314.
{
"affected": [],
"aliases": [
"CVE-2024-7239"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-22T22:15:16Z",
"severity": "HIGH"
},
"details": "VIPRE Advanced Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the Anti Malware Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22314.",
"id": "GHSA-jx3w-xgxj-7c49",
"modified": "2024-11-23T03:31:58Z",
"published": "2024-11-23T03:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7239"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1010"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-48.1
Strategy: Separation of Privilege
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack
An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.