CWE-61
AllowedUNIX Symbolic Link (Symlink) Following
Abstraction: Compound · Status: Incomplete
The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
272 vulnerabilities reference this CWE, most recent first.
GHSA-XVW3-FVP9-CWJW
Vulnerability from github – Published: 2024-12-25 15:30 – Updated: 2024-12-25 15:30Dell SupportAssist for Home PCs versions 4.6.1 and prior and Dell SupportAssist for Business PCs versions 4.5.0 and prior, contain a symbolic link (symlink) attack vulnerability in the software remediation component. A low-privileged authenticated user could potentially exploit this vulnerability, gaining privileges escalation, leading to arbitrary deletion of files and folders from the system.
{
"affected": [],
"aliases": [
"CVE-2024-52535"
],
"database_specific": {
"cwe_ids": [
"CWE-59",
"CWE-61"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-25T15:15:07Z",
"severity": "HIGH"
},
"details": "Dell SupportAssist for Home PCs versions 4.6.1 and prior and Dell SupportAssist for Business PCs versions 4.5.0 and prior, contain a symbolic link (symlink) attack vulnerability in the software remediation component. A low-privileged authenticated user could potentially exploit this vulnerability, gaining privileges escalation, leading to arbitrary deletion of files and folders from the system.",
"id": "GHSA-xvw3-fvp9-cwjw",
"modified": "2024-12-25T15:30:42Z",
"published": "2024-12-25T15:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52535"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000261086/dsa-2024-470-security-update-for-dell-supportassist-for-home-pcs-and-dell-supportassist-for-business-pcs-vulnerabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XX64-WWV2-HCQQ
Vulnerability from github – Published: 2026-05-06 17:26 – Updated: 2026-05-06 17:26Impact
In versions 0.6.0 and earlier of astral-tokio-tar, the unpack_in API could inadvertently modify the permissions of external (i.e. non-archive) directories outside of the archive. An attacker could use this to contrite a tar archive that maliciously changes directory permissions outside of its intended hierarchy. This flaw only affects directories; individual file permissions cannot be modified via it.
See GHSA-j4xf-2g29-59ph for the equivalent flaw in the tar crate.
Patches
Versions 0.6.1 and newer of astral-tokio-tar use fs::symlink_metdata rather than fs::metadata, avoiding the traversal.
Workarounds
Users are advised to upgrade to version 0.6.1 or newer to address this advisory.
Users should experience no breaking changes as a result of the patch above.
Resources
- GHSA-j4xf-2g29-59ph for the original
tarvulnerability
Attribution
- Reporter: Adam Harvey (@lawngnome)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.6.0"
},
"package": {
"ecosystem": "crates.io",
"name": "astral-tokio-tar"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.6.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-61"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-06T17:26:38Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "### Impact\n\nIn versions 0.6.0 and earlier of astral-tokio-tar, the `unpack_in` API could inadvertently modify the permissions of external (i.e. non-archive) directories outside of the archive. An attacker could use this to contrite a tar archive that maliciously changes directory permissions outside of its intended hierarchy. This flaw only affects directories; individual file permissions cannot be modified via it.\n\nSee GHSA-j4xf-2g29-59ph for the equivalent flaw in the `tar` crate.\n\n### Patches\n\nVersions 0.6.1 and newer of astral-tokio-tar use `fs::symlink_metdata` rather than `fs::metadata`, avoiding the traversal. \n\n### Workarounds\n\nUsers are advised to upgrade to version 0.6.1 or newer to address this advisory.\n\nUsers should experience no breaking changes as a result of the patch above.\n\n### Resources\n\n- GHSA-j4xf-2g29-59ph for the original `tar` vulnerability\n\n### Attribution\n\n- Reporter: Adam Harvey (@lawngnome)",
"id": "GHSA-xx64-wwv2-hcqq",
"modified": "2026-05-06T17:26:39Z",
"published": "2026-05-06T17:26:38Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/astral-sh/tokio-tar/security/advisories/GHSA-xx64-wwv2-hcqq"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-xx64-wwv2-hcqq"
},
{
"type": "PACKAGE",
"url": "https://github.com/astral-sh/tokio-tar"
},
{
"type": "WEB",
"url": "https://rustsec.org/advisories/RUSTSEC-2026-0113.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
"type": "CVSS_V4"
}
],
"summary": "astral-tokio-tar: `unpack_in` can chmod arbitrary directories by following symlinks"
}
Mitigation
Symbolic link attacks often occur when a program creates a tmp directory that stores files/links. Access to the directory should be restricted to the program as to prevent attackers from manipulating the files.
Mitigation MIT-48.1
Strategy: Separation of Privilege
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-27: Leveraging Race Conditions via Symbolic Links
This attack leverages the use of symbolic links (Symlinks) in order to write to sensitive files. An attacker can create a Symlink link to a target file not otherwise accessible to them. When the privileged program tries to create a temporary file with the same name as the Symlink link, it will actually write to the target file pointed to by the attackers' Symlink link. If the attacker can insert malicious content in the temporary file they will be writing to the sensitive file by using the Symlink. The race occurs because the system checks if the temporary file exists, then creates the file. The attacker would typically create the Symlink during the interval between the check and the creation of the temporary file.