CWE-59
AllowedImproper Link Resolution Before File Access ('Link Following')
Abstraction: Base · Status: Draft
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
1990 vulnerabilities reference this CWE, most recent first.
GHSA-68V9-MPJ8-43V9
Vulnerability from github – Published: 2025-10-29 21:30 – Updated: 2025-10-29 21:30Razer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the Razer Chroma SDK installer. By creating a symbolic link, an attacker can abuse the installer to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26373.
{
"affected": [],
"aliases": [
"CVE-2025-9871"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-29T20:15:37Z",
"severity": "HIGH"
},
"details": "Razer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the Razer Chroma SDK installer. By creating a symbolic link, an attacker can abuse the installer to delete arbitrary files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-26373.",
"id": "GHSA-68v9-mpj8-43v9",
"modified": "2025-10-29T21:30:33Z",
"published": "2025-10-29T21:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-9871"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-920"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-693H-V7JP-H34F
Vulnerability from github – Published: 2025-05-13 18:30 – Updated: 2025-05-13 18:30Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2025-29975"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-13T17:15:58Z",
"severity": "HIGH"
},
"details": "Improper link resolution before file access (\u0027link following\u0027) in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-693h-v7jp-h34f",
"modified": "2025-05-13T18:30:55Z",
"published": "2025-05-13T18:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29975"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29975"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-697Q-W597-8XCG
Vulnerability from github – Published: 2024-10-07 18:31 – Updated: 2024-10-07 18:31A potential security vulnerability has been identified in the HP Hotkey Support software, which might allow local escalation of privilege. HP is releasing mitigation for the potential vulnerability. Customers using HP Programmable Key are recommended to update HP Hotkey Support.
{
"affected": [],
"aliases": [
"CVE-2024-27458"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-07T17:15:15Z",
"severity": "HIGH"
},
"details": "A potential security vulnerability has been identified in the HP Hotkey Support software, which might allow local escalation of privilege. HP is releasing mitigation for the potential vulnerability. Customers using HP Programmable Key are recommended to update HP Hotkey Support.",
"id": "GHSA-697q-w597-8xcg",
"modified": "2024-10-07T18:31:09Z",
"published": "2024-10-07T18:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27458"
},
{
"type": "WEB",
"url": "https://support.hp.com/us-en/document/ish_11342101-11342130-16/hpsbhf03977"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-69P6-GP5X-J269
Vulnerability from github – Published: 2024-07-25 21:31 – Updated: 2024-11-18 16:26In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image (such as icons and desktop files etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained symbolic links at these paths could then cause snapd to write out the contents of the symbolic link destination into a world-readable directory. This in-turn could allow an unprivileged user to gain access to privileged information.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/snapcore/snapd"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.62"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-29069"
],
"database_specific": {
"cwe_ids": [
"CWE-59",
"CWE-610"
],
"github_reviewed": true,
"github_reviewed_at": "2024-07-26T16:39:29Z",
"nvd_published_at": "2024-07-25T20:15:04Z",
"severity": "LOW"
},
"details": "In snapd versions prior to 2.62, snapd failed to properly check the destination of symbolic links when extracting a snap. The snap format is a squashfs file-system image and so can contain symbolic links and other file types. Various file entries within the snap squashfs image (such as icons and desktop files etc) are directly read by snapd when it is extracted. An attacker who could convince a user to install a malicious snap which contained symbolic links at these paths could then cause snapd to write out the contents of the symbolic link destination into a world-readable directory. This in-turn could allow an unprivileged user to gain access to privileged information.",
"id": "GHSA-69p6-gp5x-j269",
"modified": "2024-11-18T16:26:55Z",
"published": "2024-07-25T21:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29069"
},
{
"type": "WEB",
"url": "https://github.com/snapcore/snapd/pull/13682"
},
{
"type": "WEB",
"url": "https://github.com/snapcore/snapd/commit/b66fee81606a1c05f965a876ccbaf44174194063"
},
{
"type": "PACKAGE",
"url": "https://github.com/snapcore/snapd"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2024-3009"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "snapd failed to properly check the destination of symbolic links when extracting a snap"
}
GHSA-6C6M-G479-H6F3
Vulnerability from github – Published: 2025-07-08 18:31 – Updated: 2025-07-08 18:31Improper link resolution before file access ('link following') in Service Fabric allows an authorized attacker to elevate privileges locally.
{
"affected": [],
"aliases": [
"CVE-2025-21195"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-08T17:15:33Z",
"severity": "MODERATE"
},
"details": "Improper link resolution before file access (\u0027link following\u0027) in Service Fabric allows an authorized attacker to elevate privileges locally.",
"id": "GHSA-6c6m-g479-h6f3",
"modified": "2025-07-08T18:31:43Z",
"published": "2025-07-08T18:31:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21195"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21195"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6C7C-85QV-WVGP
Vulnerability from github – Published: 2022-10-29 19:00 – Updated: 2022-11-01 12:00multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.
{
"affected": [],
"aliases": [
"CVE-2022-41973"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-29T18:15:00Z",
"severity": "HIGH"
},
"details": "multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root.",
"id": "GHSA-6c7c-85qv-wvgp",
"modified": "2022-11-01T12:00:37Z",
"published": "2022-10-29T19:00:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41973"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1202739"
},
{
"type": "WEB",
"url": "https://github.com/opensvc/multipath-tools/releases/tag/0.9.2"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/12/msg00037.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIGZM5NOOMFDCITOLQEJNNX5SCRQLQVV"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QIGZM5NOOMFDCITOLQEJNNX5SCRQLQVV"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202311-06"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5366"
},
{
"type": "WEB",
"url": "https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2022/Dec/4"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2022/Oct/25"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/10/24/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/11/30/2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6C9M-2JHW-8335
Vulnerability from github – Published: 2022-05-13 01:29 – Updated: 2022-05-13 01:29MySQL before 5.1.46 allows local users to delete the data and index files of another user's MyISAM table via a symlink attack in conjunction with the DROP TABLE command, a different vulnerability than CVE-2008-4098 and CVE-2008-7247.
{
"affected": [],
"aliases": [
"CVE-2010-1626"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2010-05-21T17:30:00Z",
"severity": "LOW"
},
"details": "MySQL before 5.1.46 allows local users to delete the data and index files of another user\u0027s MyISAM table via a symlink attack in conjunction with the DROP TABLE command, a different vulnerability than CVE-2008-4098 and CVE-2008-7247.",
"id": "GHSA-6c9m-2jhw-8335",
"modified": "2022-05-13T01:29:45Z",
"published": "2022-05-13T01:29:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1626"
},
{
"type": "WEB",
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9490"
},
{
"type": "WEB",
"url": "http://bugs.mysql.com/bug.php?id=40980"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00005.html"
},
{
"type": "WEB",
"url": "http://securitytracker.com/id?1024004"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:101"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2010/05/10/2"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2010/05/18/4"
},
{
"type": "WEB",
"url": "http://www.redhat.com/support/errata/RHSA-2010-0442.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/40257"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-1397-1"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2010/1194"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6CMG-J379-64RM
Vulnerability from github – Published: 2026-01-15 00:31 – Updated: 2026-01-15 00:31An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges.
{
"affected": [],
"aliases": [
"CVE-2025-13154"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-14T23:15:55Z",
"severity": "MODERATE"
},
"details": "An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges.",
"id": "GHSA-6cmg-j379-64rm",
"modified": "2026-01-15T00:31:38Z",
"published": "2026-01-15T00:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13154"
},
{
"type": "WEB",
"url": "https://support.lenovo.com/us/en/product_security/LEN-208293"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6CX8-Q77V-F378
Vulnerability from github – Published: 2024-12-12 03:33 – Updated: 2024-12-12 03:33WmsRepair Service Elevation of Privilege Vulnerability
{
"affected": [],
"aliases": [
"CVE-2024-49107"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-12T02:04:36Z",
"severity": "HIGH"
},
"details": "WmsRepair Service Elevation of Privilege Vulnerability",
"id": "GHSA-6cx8-q77v-f378",
"modified": "2024-12-12T03:33:05Z",
"published": "2024-12-12T03:33:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49107"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49107"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6G5M-97V8-HH8J
Vulnerability from github – Published: 2022-05-14 03:01 – Updated: 2022-05-14 03:01An issue was discovered in Cinnamon 1.9.2 through 3.8.6. The cinnamon-settings-users.py GUI runs as root and allows configuration of (for example) other users' icon files in _on_face_browse_menuitem_activated and _on_face_menuitem_activated. These icon files are written to the respective user's $HOME/.face location. If an unprivileged user prepares a symlink pointing to an arbitrary location, then this location will be overwritten with the icon content.
{
"affected": [],
"aliases": [
"CVE-2018-13054"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-02T14:29:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in Cinnamon 1.9.2 through 3.8.6. The cinnamon-settings-users.py GUI runs as root and allows configuration of (for example) other users\u0027 icon files in _on_face_browse_menuitem_activated and _on_face_menuitem_activated. These icon files are written to the respective user\u0027s $HOME/.face location. If an unprivileged user prepares a symlink pointing to an arbitrary location, then this location will be overwritten with the icon content.",
"id": "GHSA-6g5m-97v8-hh8j",
"modified": "2022-05-14T03:01:06Z",
"published": "2022-05-14T03:01:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13054"
},
{
"type": "WEB",
"url": "https://github.com/linuxmint/Cinnamon/pull/7683"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1083067"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2018/07/msg00011.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-48.1
Strategy: Separation of Privilege
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack
An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.