CWE-59
AllowedImproper Link Resolution Before File Access ('Link Following')
Abstraction: Base · Status: Draft
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
1992 vulnerabilities reference this CWE, most recent first.
GHSA-77GX-3RJC-296Q
Vulnerability from github – Published: 2022-05-17 04:06 – Updated: 2025-04-12 12:52kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log.
{
"affected": [],
"aliases": [
"CVE-2015-1338"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-10-01T20:59:00Z",
"severity": "HIGH"
},
"details": "kernel_crashdump in Apport before 2.19 allows local users to cause a denial of service (disk consumption) or possibly gain privileges via a (1) symlink or (2) hard link attack on /var/crash/vmcore.log.",
"id": "GHSA-77gx-3rjc-296q",
"modified": "2025-04-12T12:52:26Z",
"published": "2022-05-17T04:06:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-1338"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ubuntu/+source/apport/+bug/1492570"
},
{
"type": "WEB",
"url": "https://launchpad.net/apport/trunk/2.19"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/38353"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/133723/Ubuntu-Apport-kernel_crashdump-Symlink.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2015/Sep/101"
},
{
"type": "WEB",
"url": "http://www.halfdog.net/Security/2015/ApportKernelCrashdumpFileAccessVulnerabilities"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2744-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-77QJ-G9F7-XQJ9
Vulnerability from github – Published: 2024-02-13 18:38 – Updated: 2024-02-13 18:38Microsoft Azure File Sync Elevation of Privilege Vulnerability
{
"affected": [],
"aliases": [
"CVE-2024-21397"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-13T18:15:58Z",
"severity": "MODERATE"
},
"details": "Microsoft Azure File Sync Elevation of Privilege Vulnerability",
"id": "GHSA-77qj-g9f7-xqj9",
"modified": "2024-02-13T18:38:24Z",
"published": "2024-02-13T18:38:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21397"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21397"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-788G-9RGV-XQPG
Vulnerability from github – Published: 2022-05-17 02:18 – Updated: 2022-05-17 02:18aegis 4.24 and aegis-web 4.24 allow local users to overwrite arbitrary files via a symlink attack on (a) /tmp/#####, (b) /tmp/#####.intro, (c) /tmp/aegis.#####.ae, (d) /tmp/aegis.#####, (e) /tmp/aegis.#####.1, (f) /tmp/aegis.#####.2, (g) /tmp/aegis.#####.log, and (h) /tmp/aegis.#####.out temporary files, related to the (1) bng_dvlpd.sh, (2) bng_rvwd.sh, (3) awt_dvlp.sh, (4) awt_intgrtn.sh, and (5) aegis.cgi scripts.
{
"affected": [],
"aliases": [
"CVE-2008-4938"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-11-05T15:00:00Z",
"severity": "MODERATE"
},
"details": "aegis 4.24 and aegis-web 4.24 allow local users to overwrite arbitrary files via a symlink attack on (a) /tmp/#####, (b) /tmp/#####.intro, (c) /tmp/aegis.#####.ae, (d) /tmp/aegis.#####, (e) /tmp/aegis.#####.1, (f) /tmp/aegis.#####.2, (g) /tmp/aegis.#####.log, and (h) /tmp/aegis.#####.out temporary files, related to the (1) bng_dvlpd.sh, (2) bng_rvwd.sh, (3) awt_dvlp.sh, (4) awt_intgrtn.sh, and (5) aegis.cgi scripts.",
"id": "GHSA-788g-9rgv-xqpg",
"modified": "2022-05-17T02:18:33Z",
"published": "2022-05-17T02:18:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-4938"
},
{
"type": "WEB",
"url": "https://bugs.gentoo.org/show_bug.cgi?id=235770"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44835"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/496400"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/496402"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=496402"
},
{
"type": "WEB",
"url": "http://dev.gentoo.org/~rbu/security/debiantemp/aegis"
},
{
"type": "WEB",
"url": "http://dev.gentoo.org/~rbu/security/debiantemp/aegis-web"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/31970"
},
{
"type": "WEB",
"url": "http://sourceforge.net/tracker/index.php?func=detail\u0026aid=2079025\u0026group_id=224\u0026atid=100224"
},
{
"type": "WEB",
"url": "http://uvw.ru/report.lenny.txt"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2008/10/30/2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/30883"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-78GC-JMVW-X2MX
Vulnerability from github – Published: 2022-05-17 02:02 – Updated: 2025-04-11 03:45The Debian GNU/Linux /etc/cron.d/php5 cron job for PHP 5.3.5 allows local users to delete arbitrary files via a symlink attack on a directory under /var/lib/php5/.
{
"affected": [],
"aliases": [
"CVE-2011-0441"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2011-03-29T18:55:00Z",
"severity": "MODERATE"
},
"details": "The Debian GNU/Linux /etc/cron.d/php5 cron job for PHP 5.3.5 allows local users to delete arbitrary files via a symlink attack on a directory under /var/lib/php5/.",
"id": "GHSA-78gc-jmvw-x2mx",
"modified": "2025-04-11T03:45:42Z",
"published": "2022-05-17T02:02:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2011-0441"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/66180"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618489"
},
{
"type": "WEB",
"url": "http://git.debian.org/?p=pkg-php/php.git%3Ba=commit%3Bh=d09fd04ed7bfcf7f008360c6a42025108925df09"
},
{
"type": "WEB",
"url": "http://git.debian.org/?p=pkg-php/php.git;a=commit;h=d09fd04ed7bfcf7f008360c6a42025108925df09"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2011:069"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/46928"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2011/0910"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-78HJ-H3PF-359H
Vulnerability from github – Published: 2026-07-18 09:32 – Updated: 2026-07-18 09:32A vulnerability was found in AstrBotDevs AstrBot up to 4.25.5. Impacted is the function _normalize_rw_path of the file astrbot/core/tools/computer_tools/fs.py of the component Filesystem Computer-Use Tool. Performing a manipulation results in link following. The attack is only possible with local access. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2026-16077"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-18T07:16:39Z",
"severity": "LOW"
},
"details": "A vulnerability was found in AstrBotDevs AstrBot up to 4.25.5. Impacted is the function _normalize_rw_path of the file astrbot/core/tools/computer_tools/fs.py of the component Filesystem Computer-Use Tool. Performing a manipulation results in link following. The attack is only possible with local access. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-78hj-h3pf-359h",
"modified": "2026-07-18T09:32:17Z",
"published": "2026-07-18T09:32:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16077"
},
{
"type": "WEB",
"url": "https://gist.github.com/YLChen-007/d2581be79bb3caf9a032b0614dfc7728"
},
{
"type": "WEB",
"url": "https://vuldb.com/cve/CVE-2026-16077"
},
{
"type": "WEB",
"url": "https://vuldb.com/submit/852865"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/379792"
},
{
"type": "WEB",
"url": "https://vuldb.com/vuln/379792/cti"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-78QG-Q6HH-66C3
Vulnerability from github – Published: 2022-05-17 03:16 – Updated: 2022-05-17 03:16Backup in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via a crafted app that creates a symlink.
{
"affected": [],
"aliases": [
"CVE-2015-5752"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-08-17T00:00:00Z",
"severity": "MODERATE"
},
"details": "Backup in Apple iOS before 8.4.1 allows attackers to bypass intended restrictions on filesystem access via a crafted app that creates a symlink.",
"id": "GHSA-78qg-q6hh-66c3",
"modified": "2022-05-17T03:16:23Z",
"published": "2022-05-17T03:16:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5752"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT205030"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00002.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/76337"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1033275"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-796P-JV3P-9CM6
Vulnerability from github – Published: 2022-04-29 01:28 – Updated: 2022-04-29 01:28nsr_shutdown in Fujitsu Siemens NetWorker 6.0 allows local users to overwrite arbitrary files via a symlink attack on the nsrsh[PID] temporary file.
{
"affected": [],
"aliases": [
"CVE-2003-1528"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2003-12-31T05:00:00Z",
"severity": "HIGH"
},
"details": "nsr_shutdown in Fujitsu Siemens NetWorker 6.0 allows local users to overwrite arbitrary files via a symlink attack on the nsrsh[PID] temporary file.",
"id": "GHSA-796p-jv3p-9cm6",
"modified": "2022-04-29T01:28:13Z",
"published": "2022-04-29T01:28:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2003-1528"
},
{
"type": "WEB",
"url": "http://securityreason.com/securityalert/3353"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/350237/30/21640/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/9446"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id?1008801"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-79PV-JCHP-Q27M
Vulnerability from github – Published: 2022-05-14 02:47 – Updated: 2025-04-20 03:38AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. NOTE: This vulnerability exists due to an incomplete fix for CVE-2015-7723.
{
"affected": [],
"aliases": [
"CVE-2015-7724"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-07T14:29:00Z",
"severity": "HIGH"
},
"details": "AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. NOTE: This vulnerability exists due to an incomplete fix for CVE-2015-7723.",
"id": "GHSA-79pv-jchp-q27m",
"modified": "2025-04-20T03:38:35Z",
"published": "2022-05-14T02:47:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7724"
},
{
"type": "WEB",
"url": "https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-7724"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/134120/AMD-fglrx-driver-15.7-Privilege-Escalation.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2015/Oct/103"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/536782/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/77361"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7C44-7J7V-W554
Vulnerability from github – Published: 2023-12-22 12:31 – Updated: 2024-01-03 21:45A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/buildkite/elastic-ci-stack-for-aws/v6"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "6.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-43116"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-03T21:45:42Z",
"nvd_published_at": "2023-12-22T10:15:11Z",
"severity": "HIGH"
},
"details": "A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script.",
"id": "GHSA-7c44-7j7v-w554",
"modified": "2024-01-03T21:45:42Z",
"published": "2023-12-22T12:31:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-43116"
},
{
"type": "WEB",
"url": "https://github.com/buildkite/elastic-ci-stack-for-aws/commit/8f79882b6aa18fb8fc61f10c7047d2907b7a2f69"
},
{
"type": "WEB",
"url": "https://github.com/atredispartners/advisories/blob/master/ATREDIS-2023-0003.md"
},
{
"type": "PACKAGE",
"url": "https://github.com/buildkite/elastic-ci-stack-for-aws"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Buildkite Elastic CI for AWS symbolic link following vulnerability"
}
GHSA-7C58-VXQ5-5V66
Vulnerability from github – Published: 2022-05-14 02:47 – Updated: 2025-04-20 03:38AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack.
{
"affected": [],
"aliases": [
"CVE-2015-7723"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-06-07T14:29:00Z",
"severity": "HIGH"
},
"details": "AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack.",
"id": "GHSA-7c58-vxq5-5v66",
"modified": "2025-04-20T03:38:35Z",
"published": "2022-05-14T02:47:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-7723"
},
{
"type": "WEB",
"url": "https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-7723"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/134121/AMD-fglrx-driver-14.4.2-Privilege-Escalation.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2015/Oct/104"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/archive/1/536783/100/0/threaded"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/77357"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-48.1
Strategy: Separation of Privilege
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack
An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.