cve.bz

CWE-59: Improper Link Resolution Before File Access (Link Following), page 10

Filter

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

What the weakness is: CWE-59 at MITRE

Ask an AI about CWE-59

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-59: Improper Link Resolution Before File Access and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/59.html and https://cve.bz/cve/cwe/59?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2026-25187EPSS 3.2%

    Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally.

  2. 6.3CVE-2026-28689EPSS 0.1%

    ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, domain="path" authorization is checked before final file open/use. A symlink swap between check-time a…

  3. 8.2CVE-2026-29786EPSS 0.5%

    node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables fil…

  4. 7.1CVE-2026-27748EPSS 0.2%

    Avira Internet Security contains an improper link resolution vulnerability in the Software Updater component. During the update process, a privileged service running as SYSTEM deletes a file under C:\\ProgramData without validating whether…

  5. 8.6CVE-2026-27905EPSS 0.3%

    BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.36, the safe_extract_tarfile() function validates that each tar member's path is within the destination directory, but …

  6. 7.8CVE-2026-25906EPSS 0.2%

    Dell Optimizer, versions prior to 6.3.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevatio…

  7. 7.1CVE-2025-66680EPSS 0.2%

    An issue in the WiseDelfile64.sys component of WiseCleaner Wise Force Deleter 7.3.2 and earlier allows attackers to delete arbitrary files via a crafted request.

  8. 8.4CVE-2025-48582EPSS 0.1%

    In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE permission due to an intent redirect. This could lead to local escalation of privilege with no additional execution privileges needed. User …

  9. 7.1CVE-2026-27967EPSS 0.3%

    Zed, a code editor, has a symlink escape vulnerability in versions prior to 0.225.9 in Agent file tools (`read_file`, `edit_file`). It allows reading and writing files **outside the project directory** when a project contains symbolic link…

  10. 7.4CVE-2025-63946EPSS 0.2%

    A privilege escalation (PE) vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to s…

  11. 7.4CVE-2025-63945EPSS 0.2%

    A privilege escalation (PE) vulnerability in the Tencent iOA app thru 210.9.28693.621001 on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to succe…

  12. 5.5CVE-2026-2490EPSS 0.4%

    RustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of RustDesk Client for Windows. An attacke…

  13. 7.1CVE-2026-2627EPSS 0.3%

    A security flaw has been discovered in Softland FBackup up to 9.9. This impacts an unknown function in the library C:\Program Files\Common Files\microsoft shared\ink\HID.dll of the component Backup/Restore. The manipulation results in link…

  14. 8.5CVE-2026-26225EPSS 0.2%

    Intego Personal Backup, a macOS backup utility that allows users to create scheduled backups and bootable system clones, contains a local privilege escalation vulnerability. Backup task definitions are stored in a location writable by non-…

  15. 7.8CVE-2026-20610EPSS 0.2%

    This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26.3. An app may be able to gain root privileges.

  16. 9.2CVE-2025-66277EPSS 0.7%

    A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to traverse the file system to unintended locations. We have already fixed the vuln…

  17. 7.0CVE-2026-21517EPSS 0.4%

    Improper link resolution before file access ('link following') in Windows App for Mac allows an authorized attacker to elevate privileges locally.

  18. 7.1CVE-2025-62676EPSS 0.2%

    An Improper Link Resolution Before File Access ('Link Following') vulnerability [CWE-59] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.4, FortiClientWindows 7.2.0 through 7.2.12, FortiClientWindows 7.0 all versions may all…

  19. 8.1CVE-2025-15314EPSS 0.4%

    Tanium addressed an arbitrary file deletion vulnerability in end-user-cx.

  20. 7.1CVE-2025-15313EPSS 0.2%

    Tanium addressed an arbitrary file deletion vulnerability in Tanium EUSS.

  21. 7.8CVE-2025-15310EPSS 0.2%

    Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.

  22. 7.8CVE-2025-15319EPSS 0.2%

    Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.

  23. 6.0CVE-2025-15318EPSS 0.2%

    Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools.

  24. 6.6CVE-2026-21419EPSS 0.2%

    Dell Display and Peripheral Manager (Windows) versions prior to 2.2 contain an Improper Link Resolution Before File Access ('Link Following') vulnerability in the Installer and Service. A low privileged attacker with local access could pot…

  25. 5.0CVE-2025-15328EPSS 0.2%

    Tanium addressed an improper link resolution before file access vulnerability in Enforce.

  26. 6.6CVE-2025-15324EPSS 0.2%

    Tanium addressed a documentation issue in Engage.

  27. 7.8CVE-2026-24884EPSS 0.3%

    Compressing is a compressing and uncompressing lib for node. In version 2.0.0 and 1.10.3 and prior, Compressing extracts TAR archives while restoring symbolic links without validating their targets. By embedding symlinks that resolve outsi…

  28. 6.1CVE-2025-69431EPSS 0.3%

    The ZSPACE Q2C NAS contains a vulnerability related to incorrect symbolic link following. Attackers can format a USB drive to ext4, create a symbolic link to its root directory, insert the drive into the NAS device's slot, and then access …

  29. 6.1CVE-2025-69430EPSS 0.3%

    An Incorrect Symlink Follow vulnerability exists in multiple Yottamaster NAS devices, including DM2 (version equal to or prior to V1.9.12), DM3 (version equal to or prior to V1.9.12), and DM200 (version equal to or prior to V1.2.23) that c…

  30. 6.1CVE-2025-69429EPSS 0.3%

    The ORICO NAS CD3510 (version V1.9.12 and below) contains an Incorrect Symlink Follow vulnerability that could be exploited by attackers to leak or tamper with the internal file system. Attackers can format a USB drive to ext4, create a sy…

  31. 5.1CVE-2025-15543EPSS 0.2%

    Improper link resolution in USB HTTP access path in VX800v v1.0 allows a crafted USB device to expose root filesystem contents, giving an attacker with physical access read‑only access to system files.

  32. 6.9CVE-2025-15541EPSS 0.3%

    Improper link resolution in the VX800v v1.0 SFTP service allows authenticated adjacent attackers to use crafted symbolic links to access system files, resulting in high confidentiality impact and limited integrity risk.

  33. 7.1CVE-2026-23563EPSS 0.2%

    Improper Link Resolution Before File Access (invoked by 1E‑Explorer‑TachyonCore‑DeleteFileByPath instruction) in TeamViewer DEX - 1E Client before version 26.1 on Windows allows a low‑privileged local attacker to delete protected system fi…

  34. 8.2CVE-2026-24842EPSS 0.6%

    node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacke…

  35. 6.7CVE-2026-24056EPSS 0.5%

    pnpm is a package manager. Prior to version 10.28.2, when pnpm installs a `file:` (directory) or `git:` dependency, it follows symlinks and reads their target contents without constraining them to the package root. A malicious package cont…

  36. 6.8CVE-2025-67124EPSS 0.3%

    A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can creat…

  37. 6.8CVE-2026-23893EPSS 0.2%

    openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to symlink-following when running in privileged contexts. A token-group user can redirect file operations to arbitrary filesy…

  38. 6.3CVE-2026-24047EPSS 0.5%

    Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command line interface of Backstage. Prior to version 0.1.17, the `resolveSafeChildPath`…

  39. 7.1CVE-2026-24046EPSS 0.5%

    Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder t…

  40. 6.8CVE-2025-13154EPSS 0.1%

    An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges.

  41. 7.8CVE-2026-20941EPSS 0.5%

    Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.

  42. 4.5CVE-2026-22702EPSS 0.1%

    virtualenv is a tool for creating isolated virtual python environments. Prior to version 20.36.1, TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in virtualenv allow local attackers to perform symlink-based attacks on directory creation…

  43. 5.3CVE-2026-22701EPSS 0.1%

    filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permiss…

  44. 4.4CVE-2025-53594EPSS 0.1%

    A path traversal vulnerability has been reported to affect several product versions. If a local attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have alread…

  45. 7.3CVE-2025-12838EPSS 0.2%

    MSP360 Free Backup Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MSP360 Free Backup. An attacker must first obtain the ability to exec…

  46. 8.5CVE-2023-53973EPSS 0.2%

    Zillya Total Security 3.0.2367.0 contains a privilege escalation vulnerability that allows low-privileged users to copy files to unauthorized system locations using the quarantine module. Attackers can leverage symbolic link techniques to …

  47. 6.5CVE-2025-68279EPSS 0.4%

    Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to read arbitrary files from the server file system using crafted symbolic links in the repository. Version 5.15.1 fixes the issue.

  48. 6.5CVE-2025-68146EPSS 0.2%

    filelock is a platform-independent file lock for Python. In versions prior to 3.20.1, a Time-of-Check-Time-of-Use (TOCTOU) race condition allows local attackers to corrupt or truncate arbitrary user files through symlink attacks. The vulne…

  49. 5.2CVE-2025-14693EPSS 0.2%

    A vulnerability has been found in Ugreen DH2100+ up to 5.3.0. This affects an unknown function of the component USB Handler. Such manipulation leads to symlink following. The attack can be executed directly on the physical device. The expl…

  50. 5.5CVE-2025-43461EPSS 0.2%

    This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Tahoe 26.1. An app may be able to access protected user data.