CWE-59
Improper Link Resolution Before File Access ('Link Following')
Description
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-132 · CAPEC-17 · CAPEC-35 · CAPEC-76
CVEs mapped to this weakness (1,754)
page 10 of 88| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-44470 | Hig | 0.51 | 7.8 | 0.00 | May 13, 2026 | The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. Prior to 1.3834.0, the CoworkVMService component in Claude Desktop for Windows ran as SYSTEM and did not validate whether the VM bundle directory was a real… | ||
| CVE-2026-33694 | Hig | 0.51 | 7.8 | 0.00 | Apr 23, 2026 | This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privileges. As a result, this condition potentially facilitates arbitrary code execution, whereby an attacker may exploit the vulnerability to execute malicious code… | ||
| CVE-2026-25187 | Hig | 0.51 | 7.8 | 0.03 | Mar 10, 2026 | Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally. | ||
| CVE-2026-27748 | Hig | 0.51 | 7.8 | 0.00 | Mar 5, 2026 | Avira Internet Security contains an improper link resolution vulnerability in the Software Updater component. During the update process, a privileged service running as SYSTEM deletes a file under C:\\ProgramData without validating whether the path resolves through a symbolic… | ||
| CVE-2026-2627 | Hig | 0.51 | 7.8 | 0.00 | Feb 17, 2026 | A security flaw has been discovered in Softland FBackup up to 9.9. This impacts an unknown function in the library C:\Program Files\Common Files\microsoft shared\ink\HID.dll of the component Backup/Restore. The manipulation results in link following. The attack needs to be… | ||
| CVE-2026-20610 | Hig | 0.51 | 7.8 | 0.00 | Feb 11, 2026 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26.3. An app may be able to gain root privileges. | ||
| CVE-2025-15310 | Hig | 0.51 | 7.8 | 0.00 | Feb 10, 2026 | Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools. | ||
| CVE-2025-15319 | Hig | 0.51 | 7.8 | 0.00 | Feb 9, 2026 | Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools. | ||
| CVE-2026-20941 | Hig | 0.51 | 7.8 | 0.00 | Jan 13, 2026 | Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally. | ||
| CVE-2025-7073 | Hig | 0.51 | 7.8 | 0.00 | Dec 10, 2025 | A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe deleting files from a user-writable directory (C:\ProgramData\Atc\Feedback)… | ||
| CVE-2025-9871 | Hig | 0.51 | 7.8 | 0.00 | Oct 29, 2025 | Razer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the… | ||
| CVE-2025-9870 | Hig | 0.51 | 7.8 | 0.00 | Oct 29, 2025 | Razer Synapse 3 RazerPhilipsHueUninstall Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged… | ||
| CVE-2025-9869 | Hig | 0.51 | 7.8 | 0.00 | Oct 29, 2025 | Razer Synapse 3 Macro Module Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the… | ||
| CVE-2025-12341 | Hig | 0.51 | 7.8 | 0.00 | Oct 28, 2025 | A vulnerability was detected in ermig1979 AntiDupl up to 2.3.12. Impacted is an unknown function of the file AntiDupl.NET.WinForms.exe of the component Delete Duplicate Image Handler. The manipulation results in link following. The attack is only possible with local access. The… | ||
| CVE-2025-59281 | Hig | 0.51 | 7.8 | 0.00 | Oct 14, 2025 | Improper link resolution before file access ('link following') in XBox Gaming Services allows an authorized attacker to elevate privileges locally. | ||
| CVE-2025-59241 | Hig | 0.51 | 7.8 | 0.00 | Oct 14, 2025 | Improper link resolution before file access ('link following') in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally. | ||
| CVE-2025-62363 | Hig | 0.51 | 7.8 | 0.00 | Oct 13, 2025 | yt-grabber-tui is a terminal user interface application for downloading videos. In versions before 1.0-rc, the application allows users to configure the path to the yt-dlp executable via the path_to_yt_dlp configuration setting. An attacker with write access to the configuration… | ||
| CVE-2025-11462 | Hig | 0.51 | 7.8 | 0.00 | Oct 7, 2025 | Improper Link Resolution Before File Access in the AWS VPN Client for macOS versions 1.3.2- 5.2.0 allows a local user to execute code with elevated privileges. Insufficient validation checks on the log destination directory during log rotation could allow a non-administrator… | ||
| CVE-2025-34194 | Hig | 0.51 | 7.8 | 0.00 | Sep 19, 2025 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (Windows client deployments) contain an insecure temporary-file handling vulnerability in the PrinterInstallerClient components. The software… | ||
| CVE-2025-55317 | Hig | 0.51 | 7.8 | 0.00 | Sep 9, 2025 | Improper link resolution before file access ('link following') in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally. |
- risk 0.51cvss 7.8epss 0.00
The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. Prior to 1.3834.0, the CoworkVMService component in Claude Desktop for Windows ran as SYSTEM and did not validate whether the VM bundle directory was a real…
- risk 0.51cvss 7.8epss 0.00
This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privileges. As a result, this condition potentially facilitates arbitrary code execution, whereby an attacker may exploit the vulnerability to execute malicious code…
- risk 0.51cvss 7.8epss 0.03
Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally.
- risk 0.51cvss 7.8epss 0.00
Avira Internet Security contains an improper link resolution vulnerability in the Software Updater component. During the update process, a privileged service running as SYSTEM deletes a file under C:\\ProgramData without validating whether the path resolves through a symbolic…
- risk 0.51cvss 7.8epss 0.00
A security flaw has been discovered in Softland FBackup up to 9.9. This impacts an unknown function in the library C:\Program Files\Common Files\microsoft shared\ink\HID.dll of the component Backup/Restore. The manipulation results in link following. The attack needs to be…
- risk 0.51cvss 7.8epss 0.00
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26.3. An app may be able to gain root privileges.
- risk 0.51cvss 7.8epss 0.00
Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.
- risk 0.51cvss 7.8epss 0.00
Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.
- risk 0.51cvss 7.8epss 0.00
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
- risk 0.51cvss 7.8epss 0.00
A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. The issue arises from bdservicehost.exe deleting files from a user-writable directory (C:\ProgramData\Atc\Feedback)…
- risk 0.51cvss 7.8epss 0.00
Razer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the…
- risk 0.51cvss 7.8epss 0.00
Razer Synapse 3 RazerPhilipsHueUninstall Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged…
- risk 0.51cvss 7.8epss 0.00
Razer Synapse 3 Macro Module Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Razer Synapse 3. An attacker must first obtain the ability to execute low-privileged code on the…
- risk 0.51cvss 7.8epss 0.00
A vulnerability was detected in ermig1979 AntiDupl up to 2.3.12. Impacted is an unknown function of the file AntiDupl.NET.WinForms.exe of the component Delete Duplicate Image Handler. The manipulation results in link following. The attack is only possible with local access. The…
- risk 0.51cvss 7.8epss 0.00
Improper link resolution before file access ('link following') in XBox Gaming Services allows an authorized attacker to elevate privileges locally.
- risk 0.51cvss 7.8epss 0.00
Improper link resolution before file access ('link following') in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.
- risk 0.51cvss 7.8epss 0.00
yt-grabber-tui is a terminal user interface application for downloading videos. In versions before 1.0-rc, the application allows users to configure the path to the yt-dlp executable via the path_to_yt_dlp configuration setting. An attacker with write access to the configuration…
- risk 0.51cvss 7.8epss 0.00
Improper Link Resolution Before File Access in the AWS VPN Client for macOS versions 1.3.2- 5.2.0 allows a local user to execute code with elevated privileges. Insufficient validation checks on the log destination directory during log rotation could allow a non-administrator…
- risk 0.51cvss 7.8epss 0.00
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (Windows client deployments) contain an insecure temporary-file handling vulnerability in the PrinterInstallerClient components. The software…
- risk 0.51cvss 7.8epss 0.00
Improper link resolution before file access ('link following') in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally.