cve.bz

CWE-59: Improper Link Resolution Before File Access (Link Following), page 4

Filter

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

What the weakness is: CWE-59 at MITRE

Ask an AI about CWE-59

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-59: Improper Link Resolution Before File Access and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/59.html and https://cve.bz/cve/cwe/59?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.9CVE-2026-89021EPSS 0.4%

    MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks …

  2. 8.4CVE-2026-82049EPSS 0.2%

    In CPython 3.13 and earlier, the tarfile module's data and tar extraction filters are vulnerable to crafted archives containing a hard link to a symbolic link. Such archives may cause extraction to modify the permissions or modification ti…

  3. 2.1CVE-2026-90807EPSS 0.4%

    A vulnerability was found in nanocoai NanoClaw up to 2.1.17. This issue affects the function forwardAttachedFiles of the file src/modules/agent-to-agent/agent-route.ts of the component Attachment Handler. The manipulation results in link f…

  4. 7.6CVE-2026-90930EPSS 0.5%

    File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-deni…

  5. 5.7CVE-2026-87910EPSS 0.6%

    When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the locati…

  6. 9.3CVE-2026-89258EPSS 0.5%

    Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who c…

  7. 7.1CVE-2026-88016EPSS 0.2%

    rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and lat…

  8. 5.6CVE-2026-88265EPSS 0.1%

    A flaw was found in crun. After pivot_root, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurati…

  9. 5.6CVE-2026-88264EPSS 0.1%

    A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected ve…

  10. 8.8CVE-2026-87766EPSS 0.2%

    A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This ha…

  11. 6.0CVE-2026-78622EPSS 0.1%

    The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursiv…

  12. 7.0CVE-2026-83999EPSS 0.3%

    Improper link resolution before file access ('link following') in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.

  13. 7.8CVE-2026-81963KEVEPSS 0.4%

    Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

  14. 8.1CVE-2026-70563EPSS 0.8%

    Improper link resolution before file access ('link following') in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

  15. 4.7CVE-2026-69771EPSS 0.3%

    Improper link resolution before file access ('link following') in Windows Container Manager Service allows an authorized attacker to bypass a security feature locally.

  16. 4.7CVE-2026-69425EPSS 0.3%

    Improper link resolution before file access ('link following') in Windows NTFS allows an authorized attacker to perform tampering locally.

  17. 7.0CVE-2026-69379EPSS 0.3%

    Improper link resolution before file access ('link following') in Windows NTFS allows an authorized attacker to elevate privileges locally.

  18. 7.8CVE-2026-69289EPSS 0.4%

    Improper link resolution before file access ('link following') in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.

  19. 5.5CVE-2026-68830EPSS 0.4%

    Improper link resolution before file access ('link following') in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to disclose information locally.

  20. 8.8CVE-2026-67368EPSS 1.0%

    Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network.

  21. 5.3CVE-2026-86469EPSS 0.1%

    A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or…

  22. 2.0CVE-2026-86424EPSS 0.1%

    ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink …

  23. 1.0CVE-2026-86422EPSS 0.1%

    ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symli…

  24. 7.1CVE-2026-85583EPSS 0.6%

    SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when opening authorized asset paths. Attackers with reader role can request a logical asset under data/a…

  25. 5.2CVE-2026-85092EPSS 0.2%

    LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker wh…

  26. 7.0CVE-2026-78409EPSS 0.2%

    The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution insi…

  27. 7.1CVE-2024-14047EPSS 0.1%

    A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem…

  28. 7.8CVE-2026-19820EPSS 0.5%

    A vulnerability in the Backblaze Client allows a local user to make the system not bootable by creating a link from Backblaze's folder to Windows OS system files during a backup. Successful exploitation requires an administrator-level syst…

  29. 6.6CVE-2026-55569EPSS 0.2%

    aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains unde…

  30. 8.5CVE-2026-55108EPSS 0.8%

    KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, Get…

  31. 8.7CVE-2026-82252EPSS 0.5%

    gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules poin…

  32. 6.0CVE-2026-82248EPSS 0.3%

    gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_state::checkout() follows an existing terminal symlink during non-exclusive (incremental) materialization (destination_i…

  33. 6.8CVE-2026-59311EPSS 0.4%

    A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Int…

  34. 6.9CVE-2026-81727EPSS 0.2%

    NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardli…

  35. 8.7CVE-2026-81690EPSS 0.7%

    openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), which in CPython does not descend into symlinked directories and treat…

  36. 2.0CVE-2026-56651EPSS 0.2%

    Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without the "O_NOFOLLOW" flag. A local attacker can exploit this by creating a symlink at the expected log…

  37. 7.8CVE-2026-81572EPSS 0.2%

    In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS …

  38. 8.7CVE-2026-65647EPSS 0.7%

    Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.

  39. 7.7CVE-2026-61792EPSS 0.6%

    Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, whi…

  40. 7.0CVE-2026-66153EPSS 0.2%

    The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths.

  41. 7.8CVE-2026-79655EPSS 0.2%

    A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issu…

  42. 8.6CVE-2026-72696EPSS 0.2%

    Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable tem…

  43. 6.8CVE-2026-76845EPSS 0.2%

    adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Uti…

  44. 8.6CVE-2026-70626EPSS 0.2%

    NLTK versions before 3.9.4 contain a symlink escape vulnerability in CorpusReader.open() that allows local attackers to read arbitrary files outside the corpus root. The vulnerability exists because path validation is lexical and does not …

  45. 6.5CVE-2026-55168EPSS 0.6%

    Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated at…

  46. 5.9CVE-2026-71493EPSS 0.5%

    Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD. Prior to 0.10.45, the readFile, pathExists, isDir, and matchPaths template functions in internal/config/template/parser.go use a lexical filepath.Rel ch…

  47. 6.8CVE-2026-49114EPSS 0.2%

    In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check. A …

  48. 8.7CVE-2026-77815EPSS 0.5%

    to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment compa…

  49. 9.9CVE-2026-63125EPSS 0.7%

    Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with `can_create_images` and `can_create_instances`) can execute arbitrary code as…

  50. 7.8CVE-2026-17171EPSS 0.2%

    IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to overwrite arbitrary files due to improper resolution of symbolic links.