CWE-59
Improper Link Resolution Before File Access ('Link Following')
Description
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-132 · CAPEC-17 · CAPEC-35 · CAPEC-76
CVEs mapped to this weakness (1,658)
page 41 of 83| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2013-1867 | Med | 0.40 | 6.1 | 0.00 | Jan 30, 2020 | Gemalto Tokend 2013 has an Arbitrary File Creation/Overwrite Vulnerability | ||
| CVE-2013-1866 | Med | 0.40 | 6.1 | 0.00 | Jan 30, 2020 | OpenSC OpenSC.tokend has an Arbitrary File Creation/Overwrite Vulnerability | ||
| CVE-2016-8641 | Med | 0.40 | 6.7 | 0.01 | Aug 1, 2018 | A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and… | ||
| CVE-2016-9595 | Hig | 0.40 | 7.3 | 0.00 | Jul 27, 2018 | A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files. | ||
| CVE-2017-12258 | Med | 0.40 | 6.1 | 0.02 | Oct 5, 2017 | A vulnerability in the web-based UI of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to execute a cross-frame scripting (XFS) attack. The vulnerability exists because the affected software does not provide sufficient protections for HTML… | ||
| CVE-2015-5701 | Med | 0.40 | 6.1 | 0.00 | Aug 25, 2017 | mktexlsr revision 36855, and before revision 36626 as packaged in texlive allows local users to write to arbitrary files via a symlink attack. NOTE: this vulnerability exists due to the reversion of a fix of CVE-2015-5700. | ||
| CVE-2015-5700 | Med | 0.40 | 6.1 | 0.00 | Aug 25, 2017 | mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack. | ||
| CVE-2026-71556 | Hig | 0.39 | 7.1 | 0.00 | Aug 7, 2026 | go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a… | ||
| CVE-2026-50163 | Hig | 0.39 | 7.1 | 0.00 | Jul 17, 2026 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd… | ||
| CVE-2026-55607 | Hig | 0.39 | 8.8 | 0.01 | Jun 29, 2026 | Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and… | ||
| CVE-2026-28262 | Med | 0.39 | 6.0 | 0.00 | Jun 9, 2026 | Dell iDRAC Tools, versions prior to 11.4.1.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering. | ||
| CVE-2026-49135 | Hig | 0.39 | 7.1 | 0.00 | Jun 1, 2026 | CodexBar prior to 0.32.0 contains an insecure temporary file handling vulnerability that allows local attackers to access sensitive credentials or tamper with build artifacts by exploiting predictable file paths in the release notarization workflow. Attackers with access to the… | ||
| CVE-2026-34604 | Hig | 0.39 | 7.1 | 0.00 | Apr 1, 2026 | Tina is a headless content management system. Prior to version 2.2.2, @tinacms/graphql uses string-based path containment checks in FilesystemBridge. That blocks plain ../ traversal, but it does not resolve symlink or junction targets. If a symlink/junction already exists under… | ||
| CVE-2026-34603 | Hig | 0.39 | 7.1 | 0.00 | Apr 1, 2026 | Tina is a headless content management system. Prior to version 2.2.2, @tinacms/cli recently added lexical path-traversal checks to the dev media routes, but the implementation still validates only the path string and does not resolve symlink or junction targets. If a link… | ||
| CVE-2026-24046 | Hig | 0.39 | 7.1 | 0.00 | Jan 21, 2026 | Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read… | ||
| CVE-2025-21195 | Med | 0.39 | 6.0 | 0.00 | Jul 8, 2025 | Improper link resolution before file access ('link following') in Service Fabric allows an authorized attacker to elevate privileges locally. | ||
| CVE-2025-21347 | Med | 0.39 | 6.0 | 0.01 | Feb 11, 2025 | Windows Deployment Services Denial of Service Vulnerability | ||
| CVE-2025-21188 | Med | 0.39 | 6.0 | 0.01 | Feb 11, 2025 | Azure Network Watcher VM Extension Elevation of Privilege Vulnerability | ||
| CVE-2024-25953 | Med | 0.39 | 6.0 | 0.00 | Mar 28, 2024 | Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to denial of service, information tampering. | ||
| CVE-2024-25952 | Med | 0.39 | 6.0 | 0.00 | Mar 28, 2024 | Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to denial of service, information tampering. |
- risk 0.40cvss 6.1epss 0.00
Gemalto Tokend 2013 has an Arbitrary File Creation/Overwrite Vulnerability
- risk 0.40cvss 6.1epss 0.00
OpenSC OpenSC.tokend has an Arbitrary File Creation/Overwrite Vulnerability
- risk 0.40cvss 6.7epss 0.01
A privilege escalation vulnerability was found in nagios 4.2.x that occurs in daemon-init.in when creating necessary files and insecurely changing the ownership afterwards. It's possible for the local attacker to create symbolic links before the files are to be created and…
- risk 0.40cvss 7.3epss 0.00
A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.
- risk 0.40cvss 6.1epss 0.02
A vulnerability in the web-based UI of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to execute a cross-frame scripting (XFS) attack. The vulnerability exists because the affected software does not provide sufficient protections for HTML…
- risk 0.40cvss 6.1epss 0.00
mktexlsr revision 36855, and before revision 36626 as packaged in texlive allows local users to write to arbitrary files via a symlink attack. NOTE: this vulnerability exists due to the reversion of a fix of CVE-2015-5700.
- risk 0.40cvss 6.1epss 0.00
mktexlsr revision 22855 through revision 36625 as packaged in texlive allows local users to write to arbitrary files via a symlink attack.
- risk 0.39cvss 7.1epss 0.00
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a…
- risk 0.39cvss 7.1epss 0.00
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link("victim.secret", "<extract_base>/payload.tar.gz/evil_cwd…
- risk 0.39cvss 8.8epss 0.01
Claude Code is an agentic coding tool. From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting symlink manipulation and…
- risk 0.39cvss 6.0epss 0.00
Dell iDRAC Tools, versions prior to 11.4.1.0, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.
- risk 0.39cvss 7.1epss 0.00
CodexBar prior to 0.32.0 contains an insecure temporary file handling vulnerability that allows local attackers to access sensitive credentials or tamper with build artifacts by exploiting predictable file paths in the release notarization workflow. Attackers with access to the…
- risk 0.39cvss 7.1epss 0.00
Tina is a headless content management system. Prior to version 2.2.2, @tinacms/graphql uses string-based path containment checks in FilesystemBridge. That blocks plain ../ traversal, but it does not resolve symlink or junction targets. If a symlink/junction already exists under…
- risk 0.39cvss 7.1epss 0.00
Tina is a headless content management system. Prior to version 2.2.2, @tinacms/cli recently added lexical path-traversal checks to the dev media routes, but the implementation still validates only the path string and does not resolve symlink or junction targets. If a link…
- risk 0.39cvss 7.1epss 0.00
Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilities were vulnerable to symlink-based path traversal attacks. An attacker with access to create and execute Scaffolder templates could exploit symlinks to read…
- risk 0.39cvss 6.0epss 0.00
Improper link resolution before file access ('link following') in Service Fabric allows an authorized attacker to elevate privileges locally.
- risk 0.39cvss 6.0epss 0.01
Windows Deployment Services Denial of Service Vulnerability
- risk 0.39cvss 6.0epss 0.01
Azure Network Watcher VM Extension Elevation of Privilege Vulnerability
- risk 0.39cvss 6.0epss 0.00
Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to denial of service, information tampering.
- risk 0.39cvss 6.0epss 0.00
Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to denial of service, information tampering.