CWE-59
AllowedImproper Link Resolution Before File Access ('Link Following')
Abstraction: Base · Status: Draft
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
1990 vulnerabilities reference this CWE, most recent first.
GHSA-JVMP-6X88-C46P
Vulnerability from github – Published: 2022-05-14 02:12 – Updated: 2022-05-14 02:12An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the "libarchive" component, which allows local users to write to arbitrary files via vectors related to symlinks.
{
"affected": [],
"aliases": [
"CVE-2016-7619"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-02-20T08:59:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the \"libarchive\" component, which allows local users to write to arbitrary files via vectors related to symlinks.",
"id": "GHSA-jvmp-6x88-c46p",
"modified": "2022-05-14T02:12:45Z",
"published": "2022-05-14T02:12:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7619"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT207422"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT207423"
},
{
"type": "WEB",
"url": "https://support.apple.com/HT207487"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/94905"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1037469"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JW54-C8RR-PJPQ
Vulnerability from github – Published: 2025-06-11 18:35 – Updated: 2025-06-11 18:35os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.
{
"affected": [],
"aliases": [
"CVE-2025-0913"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-11T18:15:24Z",
"severity": "MODERATE"
},
"details": "os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink.",
"id": "GHSA-jw54-c8rr-pjpq",
"modified": "2025-06-11T18:35:43Z",
"published": "2025-06-11T18:35:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0913"
},
{
"type": "WEB",
"url": "https://go.dev/cl/672396"
},
{
"type": "WEB",
"url": "https://go.dev/issue/73702"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/ufZ8WpEsA3A"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2025-3750"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JW56-55H4-JXHW
Vulnerability from github – Published: 2022-05-13 01:28 – Updated: 2022-05-13 01:28The feh_unique_filename function in utils.c in feh before 1.11.2 might allow local users to overwrite arbitrary files via a symlink attack on a /tmp/feh_ temporary file.
{
"affected": [],
"aliases": [
"CVE-2011-0702"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-02-14T21:00:00Z",
"severity": "LOW"
},
"details": "The feh_unique_filename function in utils.c in feh before 1.11.2 might allow local users to overwrite arbitrary files via a symlink attack on a /tmp/feh_ temporary file.",
"id": "GHSA-jw56-55h4-jxhw",
"modified": "2022-05-13T01:28:02Z",
"published": "2022-05-13T01:28:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0702"
},
{
"type": "WEB",
"url": "https://github.com/derf/feh/issues/#issue/32"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ubuntu/+source/feh/+bug/607328"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=676389"
},
{
"type": "WEB",
"url": "https://derf.homelinux.org/git/feh/commit/?id=23421a86cc826dd30f3dc4f62057fafb04b3ac40"
},
{
"type": "WEB",
"url": "https://derf.homelinux.org/git/feh/commit/?id=29ab0855f044ef2fe9c295b72abefcb37f0861a5"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=612035"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2011/02/09/1"
},
{
"type": "WEB",
"url": "http://openwall.com/lists/oss-security/2011/02/09/14"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/43221"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JWHF-G3HG-W2GV
Vulnerability from github – Published: 2022-05-17 05:19 – Updated: 2022-05-17 05:19sendbug in freebsd-sendpr 3.113+5.3 on Debian GNU/Linux allows local users to overwrite arbitrary files via a symlink attack on a /tmp/pr.##### temporary file.
{
"affected": [],
"aliases": [
"CVE-2008-5142"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-11-18T16:00:00Z",
"severity": "MODERATE"
},
"details": "sendbug in freebsd-sendpr 3.113+5.3 on Debian GNU/Linux allows local users to overwrite arbitrary files via a symlink attack on a /tmp/pr.##### temporary file.",
"id": "GHSA-jwhf-g3hg-w2gv",
"modified": "2022-05-17T05:19:33Z",
"published": "2022-05-17T05:19:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-5142"
},
{
"type": "WEB",
"url": "http://lists.debian.org/debian-devel/2008/08/msg00285.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/32381"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JWP9-9V96-94MX
Vulnerability from github – Published: 2026-07-10 00:31 – Updated: 2026-07-10 18:32decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === 'link'), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file's content. Hardlinks are limited to files on the same filesystem and cannot target directories.
{
"affected": [],
"aliases": [
"CVE-2026-39243"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-09T22:17:04Z",
"severity": "MODERATE"
},
"details": "decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries (type === \u0027link\u0027), the x.linkname field from the archive is passed directly to fs.link() without validation (index.js line 113). An attacker can craft an archive with a hardlink entry whose linkname is an absolute path to any file on the same filesystem. This creates a hardlink inside the extraction directory that shares the same inode as the target file, enabling both reading and overwriting the original file\u0027s content. Hardlinks are limited to files on the same filesystem and cannot target directories.",
"id": "GHSA-jwp9-9v96-94mx",
"modified": "2026-07-10T18:32:08Z",
"published": "2026-07-10T00:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39243"
},
{
"type": "WEB",
"url": "https://github.com/kevva/decompress/issues/113"
},
{
"type": "WEB",
"url": "https://github.com/kevva/decompress"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/decompress"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JX33-88WC-7X75
Vulnerability from github – Published: 2021-12-17 00:00 – Updated: 2021-12-21 00:00A link following denial-of-service (DoS) vulnerability in the Trend Micro Security (Consumer) 2021 familiy of products could allow an attacker to abuse the PC Health Checkup feature of the product to create symlinks that would allow modification of files which could lead to a denial-of-service.
{
"affected": [],
"aliases": [
"CVE-2021-44023"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-12-16T03:15:00Z",
"severity": "HIGH"
},
"details": "A link following denial-of-service (DoS) vulnerability in the Trend Micro Security (Consumer) 2021 familiy of products could allow an attacker to abuse the PC Health Checkup feature of the product to create symlinks that would allow modification of files which could lead to a denial-of-service.",
"id": "GHSA-jx33-88wc-7x75",
"modified": "2021-12-21T00:00:54Z",
"published": "2021-12-17T00:00:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44023"
},
{
"type": "WEB",
"url": "https://helpcenter.trendmicro.com/en-us/article/tmka-10867"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-1536"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JX3F-M8G8-PQMW
Vulnerability from github – Published: 2022-05-24 22:01 – Updated: 2024-04-04 03:08Symlink Traversal vulnerability in Belkin N900 due to misconfiguration in the SMB service.
{
"affected": [],
"aliases": [
"CVE-2013-4655"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-11-13T16:15:00Z",
"severity": "HIGH"
},
"details": "Symlink Traversal vulnerability in Belkin N900 due to misconfiguration in the SMB service.",
"id": "GHSA-jx3f-m8g8-pqmw",
"modified": "2024-04-04T03:08:44Z",
"published": "2022-05-24T22:01:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4655"
},
{
"type": "WEB",
"url": "https://www.ise.io/casestudies/exploiting-soho-routers"
},
{
"type": "WEB",
"url": "https://www.ise.io/soho_service_hacks"
},
{
"type": "WEB",
"url": "https://www.ise.io/wp-content/uploads/2017/07/soho_techreport.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JX3W-XGXJ-7C49
Vulnerability from github – Published: 2024-11-23 03:31 – Updated: 2024-11-23 03:31VIPRE Advanced Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the Anti Malware Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22314.
{
"affected": [],
"aliases": [
"CVE-2024-7239"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-22T22:15:16Z",
"severity": "HIGH"
},
"details": "VIPRE Advanced Security Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the Anti Malware Service. By creating a symbolic link, an attacker can abuse the service to delete a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-22314.",
"id": "GHSA-jx3w-xgxj-7c49",
"modified": "2024-11-23T03:31:58Z",
"published": "2024-11-23T03:31:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7239"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-24-1010"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JX4P-M4WM-VVJG
Vulnerability from github – Published: 2024-03-25 19:42 – Updated: 2024-03-25 19:42Summary
The custom action behind WiX's RemoveFolderEx functionality could allow a standard user to delete protected directories.
Details
RemoveFolderEx deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed RemoveFolderEx to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction.
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "wix"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.14.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "wix"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.0.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "WixToolset.Util.wixext"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-29188"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-25T19:42:17Z",
"nvd_published_at": "2024-03-24T20:15:08Z",
"severity": "HIGH"
},
"details": "### Summary\nThe custom action behind WiX\u0027s `RemoveFolderEx` functionality could allow a standard user to delete protected directories.\n\n### Details\n`RemoveFolderEx` deletes an entire directory tree during installation or uninstallation. It does so by recursing every subdirectory starting at a specified directory and adding each subdirectory to the list of directories Windows Installer should delete. If the setup author instructed `RemoveFolderEx` to delete a per-user folder from a per-machine installer, an attacker could create a directory junction in that per-user folder pointing to a per-machine, protected directory. Windows Installer, when executing the per-machine installer after approval by an administrator, would delete the target of the directory junction.\n",
"id": "GHSA-jx4p-m4wm-vvjg",
"modified": "2024-03-25T19:42:17Z",
"published": "2024-03-25T19:42:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/wixtoolset/issues/security/advisories/GHSA-jx4p-m4wm-vvjg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29188"
},
{
"type": "WEB",
"url": "https://github.com/wixtoolset/wix/commit/2e5960b575881567a8807e6b8b9c513138b19742"
},
{
"type": "WEB",
"url": "https://github.com/wixtoolset/wix3/commit/93eeb5f6835776694021f66d4226c262c67d487a"
},
{
"type": "PACKAGE",
"url": "https://github.com/wixtoolset/issues"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files"
}
GHSA-JX7X-RF3F-J644
Vulnerability from github – Published: 2023-10-25 18:32 – Updated: 2023-11-02 16:49In Jenkins CloudBees CD Plugin, artifacts that were previously copied from an agent to the controller are deleted after publishing by the 'CloudBees CD - Publish Artifact' post-build step.
CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during this cleanup process.
This allows attackers able to configure jobs to delete arbitrary files on the Jenkins controller file system.
CloudBees CD Plugin 1.1.33 deletes symbolic links without following them.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:electricflow"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.33"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-46654"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-30T14:57:14Z",
"nvd_published_at": "2023-10-25T18:17:40Z",
"severity": "HIGH"
},
"details": "In Jenkins CloudBees CD Plugin, artifacts that were previously copied from an agent to the controller are deleted after publishing by the \u0027CloudBees CD - Publish Artifact\u0027 post-build step.\n\nCloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during this cleanup process.\n\nThis allows attackers able to configure jobs to delete arbitrary files on the Jenkins controller file system.\n\nCloudBees CD Plugin 1.1.33 deletes symbolic links without following them.",
"id": "GHSA-jx7x-rf3f-j644",
"modified": "2023-11-02T16:49:59Z",
"published": "2023-10-25T18:32:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46654"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/electricflow-plugin/commit/e45ca8428ae45f45ca07611e802eaa0f1484ab50"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/electricflow-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2023-10-25/#SECURITY-3237"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2023/10/25/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Jenkins CloudBees CD Plugin vulnerable to arbitrary file deletion"
}
Mitigation MIT-48.1
Strategy: Separation of Privilege
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack
An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.