CWE-59
AllowedImproper Link Resolution Before File Access ('Link Following')
Abstraction: Base · Status: Draft
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
1984 vulnerabilities reference this CWE, most recent first.
GHSA-VJCJ-64VH-89F7
Vulnerability from github – Published: 2022-05-13 01:03 – Updated: 2022-05-13 01:03In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files.
{
"affected": [],
"aliases": [
"CVE-2017-16611"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-12-01T17:29:00Z",
"severity": "MODERATE"
},
"details": "In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files.",
"id": "GHSA-vjcj-64vh-89f7",
"modified": "2022-05-13T01:03:32Z",
"published": "2022-05-13T01:03:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16611"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1050459"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/01/msg00028.html"
},
{
"type": "WEB",
"url": "https://marc.info/?l=freedesktop-xorg-announce\u0026m=151188044218304\u0026w=2"
},
{
"type": "WEB",
"url": "https://marc.info/?l=freedesktop-xorg-announce\u0026m=151188049718337\u0026w=2"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201801-10"
},
{
"type": "WEB",
"url": "http://security.cucumberlinux.com/security/details.php?id=155"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2017/11/28/7"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-3500-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VJJH-7673-9X6Q
Vulnerability from github – Published: 2022-05-02 00:00 – Updated: 2022-05-02 00:00Race condition in the jas_stream_tmpfile function in libjasper/base/jas_stream.c in JasPer 1.900.1 allows local users to cause a denial of service (program exit) by creating the appropriate tmp.XXXXXXXXXX temporary file, which causes Jasper to exit. NOTE: this was originally reported as a symlink issue, but this was incorrect. NOTE: some vendors dispute the severity of this issue, but it satisfies CVE's requirements for inclusion.
{
"affected": [],
"aliases": [
"CVE-2008-3521"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-10-02T18:18:00Z",
"severity": "HIGH"
},
"details": "Race condition in the jas_stream_tmpfile function in libjasper/base/jas_stream.c in JasPer 1.900.1 allows local users to cause a denial of service (program exit) by creating the appropriate tmp.XXXXXXXXXX temporary file, which causes Jasper to exit. NOTE: this was originally reported as a symlink issue, but this was incorrect. NOTE: some vendors dispute the severity of this issue, but it satisfies CVE\u0027s requirements for inclusion.",
"id": "GHSA-vjjh-7673-9x6q",
"modified": "2022-05-02T00:00:57Z",
"published": "2022-05-02T00:00:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-3521"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-3521"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45622"
},
{
"type": "WEB",
"url": "http://bugs.gentoo.org/attachment.cgi?id=163282\u0026action=view"
},
{
"type": "WEB",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=222819"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/34391"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:142"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:164"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/31470"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-742-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-VM56-HJ47-795X
Vulnerability from github – Published: 2022-05-24 17:41 – Updated: 2022-05-24 17:41autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location.
{
"affected": [],
"aliases": [
"CVE-2020-36241"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-05T14:15:00Z",
"severity": "MODERATE"
},
"details": "autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file\u0027s parent is a symlink to a directory outside of the intended extraction location.",
"id": "GHSA-vm56-hj47-795x",
"modified": "2022-05-24T17:41:11Z",
"published": "2022-05-24T17:41:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36241"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/gnome-autoar/-/commit/adb067e645732fdbe7103516e506d09eb6a54429"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/gnome-autoar/-/issues/7"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BN5TVQ7OHZEGY6AGFLAZWCVCI53RYNHQ"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202105-10"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VM84-HXMH-36RV
Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2022-05-24 19:20In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions.
{
"affected": [],
"aliases": [
"CVE-2021-41057"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-14T21:15:00Z",
"severity": "HIGH"
},
"details": "In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions.",
"id": "GHSA-vm84-hxmh-36rv",
"modified": "2022-05-24T19:20:39Z",
"published": "2022-05-24T19:20:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41057"
},
{
"type": "WEB",
"url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210910-01.pdf"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-580693.pdf"
},
{
"type": "WEB",
"url": "https://www.wibu.com/us/support/security-advisories.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-VPFC-9392-2W4Q
Vulnerability from github – Published: 2023-05-31 00:31 – Updated: 2023-11-25 12:30Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a local attacker to perform privilege escalation via crafted symbolic link. (Chromium security severity: Medium)
{
"affected": [],
"aliases": [
"CVE-2023-2939"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-30T22:15:10Z",
"severity": "HIGH"
},
"details": "Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a local attacker to perform privilege escalation via crafted symbolic link. (Chromium security severity: Medium)",
"id": "GHSA-vpfc-9392-2w4q",
"modified": "2023-11-25T12:30:22Z",
"published": "2023-05-31T00:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2939"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html"
},
{
"type": "WEB",
"url": "https://crbug.com/1427431"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202311-11"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202401-34"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5418"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VPGM-2FHH-PJFQ
Vulnerability from github – Published: 2025-06-17 21:32 – Updated: 2025-06-17 21:32A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2025-30640"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-17T21:15:37Z",
"severity": "HIGH"
},
"details": "A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations.\n\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"id": "GHSA-vpgm-2fhh-pjfq",
"modified": "2025-06-17T21:32:30Z",
"published": "2025-06-17T21:32:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30640"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/en-US/solution/KA-0019344"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-239"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VPJM-58CW-R8Q5
Vulnerability from github – Published: 2022-05-24 17:39 – Updated: 2022-12-13 15:17The file browser for workspaces, archived artifacts, and $JENKINS_HOME/userContent/ follows symbolic links to locations outside the directory being browsed in Jenkins 2.274 and earlier, LTS 2.263.1 and earlier.
This allows attackers with Job/Workspace permission and the ability to control workspace contents (e.g., with Job/Configure permission or the ability to change SCM contents) to create symbolic links that allow them to access files outside workspaces using the workspace browser.
This issue is caused by an incomplete fix for SECURITY-904 / CVE-2018-1000862 in the 2018-12-08 security advisory.
Jenkins 2.275, LTS 2.263.2 no longer supports symlinks in workspace browsers. While they may still exist on the file system, they are no longer shown on the UI, accessible via URLs, or included in directory content downloads.
This fix only changes the behavior of the Jenkins UI. Archiving artifacts still behaves as before.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.263.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.263.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.274"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"events": [
{
"introduced": "2.264"
},
{
"fixed": "2.275"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-21602"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-23T06:52:14Z",
"nvd_published_at": "2021-01-13T16:15:00Z",
"severity": "MODERATE"
},
"details": "The file browser for workspaces, archived artifacts, and `$JENKINS_HOME/userContent/` follows symbolic links to locations outside the directory being browsed in Jenkins 2.274 and earlier, LTS 2.263.1 and earlier.\n\nThis allows attackers with Job/Workspace permission and the ability to control workspace contents (e.g., with Job/Configure permission or the ability to change SCM contents) to create symbolic links that allow them to access files outside workspaces using the workspace browser.\n\nThis issue is caused by an incomplete fix for SECURITY-904 / CVE-2018-1000862 in the [2018-12-08 security advisory](https://www.jenkins.io/security/advisory/2018-12-05/#SECURITY-904).\n\nJenkins 2.275, LTS 2.263.2 no longer supports symlinks in workspace browsers. While they may still exist on the file system, they are no longer shown on the UI, accessible via URLs, or included in directory content downloads.\n\nThis fix only changes the behavior of the Jenkins UI. Archiving artifacts still behaves as before.",
"id": "GHSA-vpjm-58cw-r8q5",
"modified": "2022-12-13T15:17:03Z",
"published": "2022-05-24T17:39:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21602"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/jenkins/commit/71d2ecf1a4e5303e80815eaa3935c4f2fa3d9104"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/jenkins"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1452"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Arbitrary file read vulnerability in workspace browsers in Jenkins"
}
GHSA-VPQP-HX68-P2WX
Vulnerability from github – Published: 2022-05-14 01:08 – Updated: 2024-10-28 14:37cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.4"
},
"package": {
"ecosystem": "PyPI",
"name": "suds"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "suds-py3"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.4.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2013-2217"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-08T19:12:30Z",
"nvd_published_at": "2013-09-23T20:55:00Z",
"severity": "MODERATE"
},
"details": "cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.",
"id": "GHSA-vpqp-hx68-p2wx",
"modified": "2024-10-28T14:37:29Z",
"published": "2022-05-14T01:08:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2217"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=978696"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-vpqp-hx68-p2wx"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/suds-py3/PYSEC-2013-33.yaml"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/suds/PYSEC-2013-32.yaml"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2013-07/msg00062.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/06/27/8"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2008-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Improper Link Resolution Before File Access in Suds"
}
GHSA-VQ5J-6VRQ-2CM6
Vulnerability from github – Published: 2025-06-03 15:31 – Updated: 2025-06-03 15:31Dell Encryption Admin Utilities versions prior to 11.10.2 contain an Improper Link Resolution vulnerability. A local malicious user could potentially exploit this vulnerability, leading to privilege escalation.
{
"affected": [],
"aliases": [
"CVE-2025-36564"
],
"database_specific": {
"cwe_ids": [
"CWE-59",
"CWE-61"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-03T15:15:58Z",
"severity": "HIGH"
},
"details": "Dell Encryption Admin Utilities versions prior to 11.10.2 contain an Improper Link Resolution vulnerability. A local malicious user could potentially exploit this vulnerability, leading to privilege escalation.",
"id": "GHSA-vq5j-6vrq-2cm6",
"modified": "2025-06-03T15:31:26Z",
"published": "2025-06-03T15:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-36564"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000325203/dsa-2025-224"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VQCM-9J25-4CQF
Vulnerability from github – Published: 2022-05-17 02:18 – Updated: 2022-05-17 02:18arb-common 0.0.20071207.1 allows local users to overwrite arbitrary files via a symlink attack on (a) /tmp/arb_fdnaml_, (b) /tmp/arb_pids_, (c) /tmp/arbdsmz.html, and (d) /tmp/arbdsmz.htm temporary files, related to the (1) arb_fastdnaml and (2) dszmconnect.pl scripts.
{
"affected": [],
"aliases": [
"CVE-2008-4941"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-11-05T15:00:00Z",
"severity": "MODERATE"
},
"details": "arb-common 0.0.20071207.1 allows local users to overwrite arbitrary files via a symlink attack on (a) /tmp/arb_fdnaml_*, (b) /tmp/arb_pids_*, (c) /tmp/arbdsmz.html, and (d) /tmp/arbdsmz.htm temporary files, related to the (1) arb_fastdnaml and (2) dszmconnect.pl scripts.",
"id": "GHSA-vqcm-9j25-4cqf",
"modified": "2022-05-17T02:18:33Z",
"published": "2022-05-17T02:18:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4941"
},
{
"type": "WEB",
"url": "https://bugs.gentoo.org/show_bug.cgi?id=235770"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44844"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/496396"
},
{
"type": "WEB",
"url": "http://dev.gentoo.org/~rbu/security/debiantemp/arb-common"
},
{
"type": "WEB",
"url": "http://uvw.ru/report.lenny.txt"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2008/10/30/2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/30895"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation MIT-48.1
Strategy: Separation of Privilege
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack
An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.