CWE-59
AllowedImproper Link Resolution Before File Access ('Link Following')
Abstraction: Base · Status: Draft
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
1990 vulnerabilities reference this CWE, most recent first.
GHSA-JGVP-3CHV-PR37
Vulnerability from github – Published: 2024-11-22 21:32 – Updated: 2024-11-22 21:32G DATA Total Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the G DATA Backup Service. By creating a symbolic link, an attacker can abuse the service to overwrite a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22313.
{
"affected": [],
"aliases": [
"CVE-2024-1868"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-22T20:15:08Z",
"severity": "HIGH"
},
"details": "G DATA Total Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the G DATA Backup Service. By creating a symbolic link, an attacker can abuse the service to overwrite a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22313.",
"id": "GHSA-jgvp-3chv-pr37",
"modified": "2024-11-22T21:32:16Z",
"published": "2024-11-22T21:32:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1868"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-558"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JGW8-64JM-9X2F
Vulnerability from github – Published: 2022-05-17 02:07 – Updated: 2025-04-11 03:35emesenelib/ProfileManager.py in emesene before 1.6.2 allows local users to overwrite arbitrary files via a symlink attack on the emsnpic temporary file.
{
"affected": [],
"aliases": [
"CVE-2010-2053"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-06-07T17:13:00Z",
"severity": "LOW"
},
"details": "emesenelib/ProfileManager.py in emesene before 1.6.2 allows local users to overwrite arbitrary files via a symlink attack on the emsnpic temporary file.",
"id": "GHSA-jgw8-64jm-9x2f",
"modified": "2025-04-11T03:35:45Z",
"published": "2022-05-17T02:07:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2053"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59045"
},
{
"type": "WEB",
"url": "http://forum.emesene.org/index.php?topic=3441.0"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042683.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042699.html"
},
{
"type": "WEB",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/042725.html"
},
{
"type": "WEB",
"url": "http://marc.info/?l=oss-security\u0026m=127514641525366\u0026w=2"
},
{
"type": "WEB",
"url": "http://osvdb.org/65018"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/39945"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/40115"
},
{
"type": "WEB",
"url": "http://www.emesene.org"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/40455"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/1423"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JHRW-H349-FV5W
Vulnerability from github – Published: 2022-05-24 19:02 – Updated: 2022-05-24 19:02Windows WalletService Elevation of Privilege Vulnerability
{
"affected": [],
"aliases": [
"CVE-2021-31187"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-11T19:15:00Z",
"severity": "HIGH"
},
"details": "Windows WalletService Elevation of Privilege Vulnerability",
"id": "GHSA-jhrw-h349-fv5w",
"modified": "2022-05-24T19:02:00Z",
"published": "2022-05-24T19:02:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31187"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31187"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-571"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JHXR-WVF5-HRP6
Vulnerability from github – Published: 2022-05-24 17:42 – Updated: 2022-06-08 00:00avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product.
{
"affected": [],
"aliases": [
"CVE-2021-26720"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-17T22:15:00Z",
"severity": "HIGH"
},
"details": "avahi-daemon-check-dns.sh in the Debian avahi package through 0.8-4 is executed as root via /etc/network/if-up.d/avahi-daemon, and allows a local attacker to cause a denial of service or create arbitrary empty files via a symlink attack on files under /run/avahi-daemon. NOTE: this only affects the packaging for Debian GNU/Linux (used indirectly by SUSE), not the upstream Avahi product.",
"id": "GHSA-jhxr-wvf5-hrp6",
"modified": "2022-06-08T00:00:32Z",
"published": "2022-05-24T17:42:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26720"
},
{
"type": "WEB",
"url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=982796"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ubuntu/+source/avahi/+bug/1870824"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1180827"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/06/msg00009.html"
},
{
"type": "WEB",
"url": "https://metadata.ftp-master.debian.org/changelogs/main/a/avahi/avahi_0.8-4_changelog"
},
{
"type": "WEB",
"url": "https://packages.debian.org/bullseye/avahi-daemon"
},
{
"type": "WEB",
"url": "https://packages.debian.org/buster/avahi-daemon"
},
{
"type": "WEB",
"url": "https://packages.debian.org/sid/avahi-daemon"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2021-26720"
},
{
"type": "WEB",
"url": "https://www.openwall.com/lists/oss-security/2021/02/15/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JMQP-VG78-6CV7
Vulnerability from github – Published: 2022-05-14 02:38 – Updated: 2022-05-14 02:38ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to obtain sensitive information via an unauthenticated add and save action for a shopping cart in cart_save.php, which reveals the SQL table names in an error message, related to code that mishandles the lack of a user_id parameter.
{
"affected": [],
"aliases": [
"CVE-2008-6760"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-04-28T16:30:00Z",
"severity": "MODERATE"
},
"details": "ViArt Shop (aka Shopping Cart) 3.5 allows remote attackers to obtain sensitive information via an unauthenticated add and save action for a shopping cart in cart_save.php, which reveals the SQL table names in an error message, related to code that mishandles the lack of a user_id parameter.",
"id": "GHSA-jmqp-vg78-6cv7",
"modified": "2022-05-14T02:38:21Z",
"published": "2022-05-14T02:38:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6760"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/53282"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/499625/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/33043"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1021497"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JP9F-F85W-RV5V
Vulnerability from github – Published: 2022-05-03 03:13 – Updated: 2022-05-03 03:13The (1) pj-gs.sh, (2) ps2epsi, (3) pv.sh, and (4) sysvlp.sh scripts in the ESP Ghostscript (espgs) package in Trustix Secure Linux 1.5 through 2.1, and other operating systems, allow local users to overwrite files via a symlink attack on temporary files.
{
"affected": [],
"aliases": [
"CVE-2004-0967"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2005-02-09T05:00:00Z",
"severity": "HIGH"
},
"details": "The (1) pj-gs.sh, (2) ps2epsi, (3) pv.sh, and (4) sysvlp.sh scripts in the ESP Ghostscript (espgs) package in Trustix Secure Linux 1.5 through 2.1, and other operating systems, allow local users to overwrite files via a symlink attack on temporary files.",
"id": "GHSA-jp9f-f85w-rv5v",
"modified": "2022-05-03T03:13:12Z",
"published": "2022-05-03T03:13:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2004-0967"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17583"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10284"
},
{
"type": "WEB",
"url": "https://www.ubuntu.com/usn/usn-3-1"
},
{
"type": "WEB",
"url": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=136321"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/16997"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/17135"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/19799"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/20056"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2005-081.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/11285"
},
{
"type": "WEB",
"url": "http://www.trustix.org/errata/2004/0050"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JPMF-8CJ2-595G
Vulnerability from github – Published: 2022-05-17 04:20 – Updated: 2022-07-07 22:33The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.hadoop:hadoop-client"
},
"ranges": [
{
"events": [
{
"introduced": "0.23.0"
},
{
"fixed": "1.0.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.hadoop:hadoop-client"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.5.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2014-3627"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-07T22:33:19Z",
"nvd_published_at": "2014-12-05T16:59:00Z",
"severity": "MODERATE"
},
"details": "The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.",
"id": "GHSA-jpmf-8cj2-595g",
"modified": "2022-07-07T22:33:19Z",
"published": "2022-05-17T04:20:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3627"
},
{
"type": "WEB",
"url": "http://mail-archives.apache.org/mod_mbox/hadoop-general/201411.mbox/%3CCALwhT97dOi04aC3VbekaB+zn2UAS_OZV2EAiP78GmjnMzfp2Ug@mail.gmail.com%3E"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Improper Link Resolution Before File Access in Apache Hadoop"
}
GHSA-JQJ7-X7FH-X429
Vulnerability from github – Published: 2022-05-17 05:51 – Updated: 2022-05-17 05:51getipacctg in rancid 2.3.2~a8 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/ipacct.#####.prefixes, (2) /tmp/ipacct.#####.sorted, (3) /tmp/ipacct.#####.pl, and (4) /tmp/ipacct.##### temporary files.
{
"affected": [],
"aliases": [
"CVE-2008-4979"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-11-06T15:55:00Z",
"severity": "MODERATE"
},
"details": "getipacctg in rancid 2.3.2~a8 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/ipacct.#####.prefixes, (2) /tmp/ipacct.#####.sorted, (3) /tmp/ipacct.#####.pl, and (4) /tmp/ipacct.##### temporary files.",
"id": "GHSA-jqj7-x7fh-x429",
"modified": "2022-05-17T05:51:55Z",
"published": "2022-05-17T05:51:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4979"
},
{
"type": "WEB",
"url": "https://bugs.gentoo.org/show_bug.cgi?id=235770"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/496426"
},
{
"type": "WEB",
"url": "http://dev.gentoo.org/~rbu/security/debiantemp/rancid-util"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/32588"
},
{
"type": "WEB",
"url": "http://uvw.ru/report.lenny.txt"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2008/10/30/2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/30954"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JRGV-PMF9-6QG5
Vulnerability from github – Published: 2025-04-01 00:30 – Updated: 2025-11-04 00:32This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access protected user data.
{
"affected": [],
"aliases": [
"CVE-2025-24278"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-31T23:15:24Z",
"severity": "CRITICAL"
},
"details": "This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.7.5, macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to access protected user data.",
"id": "GHSA-jrgv-pmf9-6qg5",
"modified": "2025-11-04T00:32:22Z",
"published": "2025-04-01T00:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24278"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122373"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122374"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/122375"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Apr/10"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Apr/8"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2025/Apr/9"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JV9Q-V37Q-34VV
Vulnerability from github – Published: 2022-05-13 01:04 – Updated: 2022-05-13 01:04The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/.
{
"affected": [],
"aliases": [
"CVE-2012-0871"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-04-18T14:55:00Z",
"severity": "MODERATE"
},
"details": "The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/.",
"id": "GHSA-jv9q-v37q-34vv",
"modified": "2022-05-13T01:04:14Z",
"published": "2022-05-13T01:04:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0871"
},
{
"type": "WEB",
"url": "https://bugzilla.novell.com/show_bug.cgi?id=747154"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=795853"
},
{
"type": "WEB",
"url": "http://cgit.freedesktop.org/systemd/systemd/commit/?id=fc3c1c6e091ea16ad5600b145201ec535bbb5d7c"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00030.html"
},
{
"type": "WEB",
"url": "http://www.osvdb.org/79768"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation MIT-48.1
Strategy: Separation of Privilege
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack
An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.