CAPEC-132

The endpoint file may be either output or input. If the file is output, the result is that the endpoint is modified, instead of a file at the intended location. Modifications to the endpoint file may include appending, overwriting, corrupting, changing permissions, or other modifications.

In some variants of this attack the adversary may be able to control the change to a file while in other cases they cannot. The former is especially damaging since the adversary may be able to grant themselves increased privileges or insert false information, but the latter can also be damaging as it can expose sensitive information or corrupt or destroy vital system or application files. Alternatively, the endpoint file may serve as input to the targeted application. This can be used to feed malformed input into the target or to cause the target to process different information, possibly allowing the adversary to control the actions of the target or to cause the target to expose information to the adversary. Moreover, the actions taken on the endpoint file are undertaken with the permissions of the targeted user or application, which may exceed the permissions that the adversary would normally have.

How the attack unfolds

1. Explore

   The attacker looks for a way in.

   1. [Identify Target] Adversary identifies the target application by determining whether there is sufficient check before writing data to a file and creating symlinks to files in different directories.

      2 techniques

      • The adversary writes to files in different directories to check whether the application has sufficient checking before file operations.
      • The adversary creates symlinks to files in different directories.

2. Experiment

   They probe what they found.

   2. [Try to create symlinks to different files] The adversary then uses a variety of techniques, such as monitoring or guessing to create symlinks to the files accessed by the target application in the directories which are identified in the explore phase.

      3 techniques

      • The adversary monitors the file operations performed by the target application using a tool like dtrace or FileMon. And the adversary can delay the operations by using "sleep(2)" and "usleep()" to prepare the appropriate conditions for the attack, or make the application perform expansive tasks (large files parsing, etc.) depending on the purpose of the application.
      • The adversary may need a little guesswork on the filenames on which the target application would operate.
      • The adversary tries to create symlinks to the various filenames.

3. Exploit

   They carry out the attack.

   3. [Target application operates on created symlinks to sensitive files] The adversary is able to create symlinks to sensitive files while the target application is operating on the file.

      1 technique

      • Create the symlink to the sensitive file such as configuration files, etc.

Prerequisites

• The targeted application must perform the desired activities on a file without checking whether the file is a symbolic link or not. The adversary must be able to predict the name of the file the target application is modifying and be able to create a new symbolic link where that file would appear.

Skills required

• Low skill

  To create symlinks

• High skill

  To identify the files and create the symlinks during the file operation time window

Resources required

• None: No specialized resources are required to execute this type of attack. The only requirement is the ability to create the necessary symbolic link.

Consequences

Mitigations

• Design: Check for the existence of files to be created, if in existence verify they are neither symlinks nor hard links before opening them.

• Implementation: Use randomly generated file names for temporary files. Give the files restrictive permissions.

Weaknesses it exploits

• CWE-59 Improper Link Resolution Before File Access

Recent CVEs with these weaknesses

1. 8.1CVE-2026-917642026-11-10

   Improper Link Resolution Before File Access Vulnerability in Hitachi Dynamic Link Manager for Linux. This issue affects Hitachi Dynamic Link Manager for Linux: from 6.1.1.-00 before 9.0.5-00.

2. 7.3CVE-2026-865782026-11-10

   Link Following Vulnerability in Hitachi Dynamic Link Manager for Windows. This issue affects Hitachi Dynamic Link Manager for Windows: from 5.0.0-03 before 9.0.4-01.

3. 2.3CVE-2026-1233732026-11-09

   compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.25.0, compose-lint follows a project-controlled symbolic link used as the Compose file outside the project. …

4. 2.3CVE-2026-1233712026-11-09

   compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.2.0 until 0.32.0, compose-lint automatically follows a .compose-lint.yml policy-file symbolic link outside the project a…

5. 2.3CVE-2026-1233682026-11-09

   compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, compose-lint follows a sibling .env symbolic link outside the project without applying its normal con…

6. 4.8CVE-2026-1245842026-11-09

   A vulnerability has been found in wummel patool 4.1.0. This vulnerability affects the function extract_gzip of the file patoolib/fileutil.py of the component Gzip Extraction Handler. The manipulation leads to symlink following. Local acces…

7. 7.1CVE-2026-1235322026-11-08

   gix-fs in gitoxide before 0.24.1 contains a credential disclosure vulnerability that allows remote attackers to capture NTLM credentials by supplying UNC symlink targets in a crafted repository. When a victim checks out the repository on W…

8. 4.8CVE-2026-1234962026-11-08

   Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode ent…

The newest records naming one of them. Each weakness's page lists them all.

Related attack patterns

Part of

• CAPEC-159 Redirect Access to Libraries

Examples

root# vulprog myFile
{...program does some processing...]

adversary# ln –s /etc/nologin myFile
[...program writes to 'myFile', which points to /etc/nologin...]

MITRE's words, unchanged: CAPEC-132 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.