CWE-59
Improper Link Resolution Before File Access ('Link Following')
Description
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-132 · CAPEC-17 · CAPEC-35 · CAPEC-76
CVEs mapped to this weakness (1,754)
page 3 of 88| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-20310 | Cri | 0.59 | 9.1 | 0.00 | Aug 5, 2026 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered… | ||
| CVE-2024-53691 | Hig | 0.59 | 8.8 | 0.23 | Dec 6, 2024 | A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations. We have already fixed the… | ||
| CVE-2024-10007 | Cri | 0.59 | 9.1 | 0.01 | Nov 7, 2024 | A path collision and arbitrary code execution vulnerability was identified in GitHub Enterprise Server that allowed container escape to escalate to root via ghe-firejail path. Exploitation of this vulnerability requires Enterprise Administrator access to the GitHub Enterprise… | ||
| CVE-2023-39107 | Cri | 0.59 | 9.1 | 0.01 | Aug 4, 2023 | An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows attackers to overwrite root-owned files by using hardlinks. | ||
| CVE-2021-38570 | Cri | 0.59 | 9.1 | 0.01 | Aug 11, 2021 | An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows attackers to delete arbitrary files (during uninstallation) via a symlink. | ||
| CVE-2020-36193 | Hig | 0.59 | 7.5 | 0.71 | KEV | Jan 18, 2021 | Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948. | |
| CVE-2020-13833 | Cri | 0.59 | 9.1 | 0.00 | Jun 4, 2020 | An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The system area allows arbitrary file overwrites via a symlink attack. The Samsung ID is SVE-2020-17183 (June 2020). | ||
| CVE-2015-5287 | Hig | 0.59 | 7.8 | 0.05 | KEV | Dec 7, 2015 | The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or… | |
| CVE-2026-34078 | Cri | 0.58 | 10.0 | 0.02 | Apr 7, 2026 | Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This… | ||
| CVE-2025-21391 | Hig | 0.58 | 7.1 | 0.02 | KEV | Feb 11, 2025 | Windows Storage Elevation of Privilege Vulnerability | |
| CVE-2022-21919 | Hig | 0.58 | 7.0 | 0.03 | KEV | Jan 11, 2022 | Windows User Profile Service Elevation of Privilege Vulnerability | |
| CVE-2020-5738 | Hig | 0.58 | 8.8 | 0.05 | Apr 14, 2020 | Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/upload_vpntar interface. | ||
| CVE-2017-1002101 | Hig | 0.58 | 8.8 | 0.13 | Mar 13, 2018 | In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can access files/directories outside of the volume, including… | ||
| CVE-2026-67368 | Hig | 0.57 | 8.8 | 0.01 | Sep 8, 2026 | Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network. | ||
| CVE-2026-65647 | Hig | 0.57 | — | 0.01 | Aug 26, 2026 | Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root. | ||
| CVE-2026-63125 | Cri | 0.57 | 9.9 | 0.01 | Aug 21, 2026 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with `can_create_images` and `can_create_instances`) can execute arbitrary code as root on the host. A crafted image ships… | ||
| CVE-2026-44881 | Cri | 0.57 | 9.9 | 0.00 | May 28, 2026 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer supports deploying stacks from Git… | ||
| CVE-2026-7374 | Cri | 0.57 | 9.9 | 0.01 | May 26, 2026 | A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket… | ||
| CVE-2021-47949 | Hig | 0.57 | 8.8 | 0.01 | May 10, 2026 | CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint. Attackers can manipulate the completeStartingPath parameter in… | ||
| CVE-2026-5161 | Hig | 0.57 | 8.8 | 0.00 | Apr 29, 2026 | Improper link resolution before file access ('link following') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Symlink Attack. This issue affects Pardus About: before 1.2.2. |
- risk 0.59cvss 9.1epss 0.00
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered…
- risk 0.59cvss 8.8epss 0.23
A link following vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to traverse the file system to unintended locations. We have already fixed the…
- risk 0.59cvss 9.1epss 0.01
A path collision and arbitrary code execution vulnerability was identified in GitHub Enterprise Server that allowed container escape to escalate to root via ghe-firejail path. Exploitation of this vulnerability requires Enterprise Administrator access to the GitHub Enterprise…
- risk 0.59cvss 9.1epss 0.01
An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows attackers to overwrite root-owned files by using hardlinks.
- risk 0.59cvss 9.1epss 0.01
An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows attackers to delete arbitrary files (during uninstallation) via a symlink.
- risk 0.59cvss 7.5epss 0.71
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
- risk 0.59cvss 9.1epss 0.00
An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The system area allows arbitrary file overwrites via a symlink attack. The Samsung ID is SVE-2020-17183 (June 2020).
- risk 0.59cvss 7.8epss 0.05
The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or…
- risk 0.58cvss 10.0epss 0.02
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths. Flatpak run mounts the resolved host path in the sandbox. This…
- risk 0.58cvss 7.1epss 0.02
Windows Storage Elevation of Privilege Vulnerability
- risk 0.58cvss 7.0epss 0.03
Windows User Profile Service Elevation of Privilege Vulnerability
- risk 0.58cvss 8.8epss 0.05
Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/upload_vpntar interface.
- risk 0.58cvss 8.8epss 0.13
In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can access files/directories outside of the volume, including…
- risk 0.57cvss 8.8epss 0.01
Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a network.
- risk 0.57cvss —epss 0.01
Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.
- risk 0.57cvss 9.9epss 0.01
Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with `can_create_images` and `can_create_instances`) can execute arbitrary code as root on the host. A crafted image ships…
- risk 0.57cvss 9.9epss 0.00
Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer supports deploying stacks from Git…
- risk 0.57cvss 9.9epss 0.01
A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation when connecting to virtual machine console sockets. By replacing the console socket…
- risk 0.57cvss 8.8epss 0.01
CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint. Attackers can manipulate the completeStartingPath parameter in…
- risk 0.57cvss 8.8epss 0.00
Improper link resolution before file access ('link following') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Symlink Attack. This issue affects Pardus About: before 1.2.2.