CWE-59— Improper Link Resolution Before File Access (Link Following)
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.— MITRE CWE catalog
1,914 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-59page 16 of 39
- CVE-2026-6064HIGHCVSS 7.3EG 7.32026-10-28
Link following vulnerability in Data Shredder components in Norton Antivirus, Avast Antivirus, and AVG Internet Security prior to 26.5.10933 on Windows allows a local, low-privileged attacker to escalate privileges to SYSTEM. During a priv…
- CVE-2026-70190HIGHCVSS 7.3EG 7.32026-10-13
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
- CVE-2026-107716HIGHCVSS 7.3EG 7.32026-10-08
Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where un…
- CVE-2026-81690HIGHCVSS 7.3EG 7.32026-08-27
openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), which in CPython does not descend into symlinked directories and treat…
- CVE-2026-50364HIGHCVSS 7.3EG 7.32026-07-14
Improper link resolution before file access ('link following') in Windows Server Backup allows an authorized attacker to elevate privileges locally.
- CVE-2026-15684HIGHCVSS 7.3EG 7.32026-07-13
Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Glarysoft Glary Utilities. An attacker must first obtain the a…
- CVE-2026-11837HIGHCVSS 7.3EG 7.32026-06-10
A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. A…
- CVE-2026-35338HIGHCVSS 7.3EG 7.32026-04-22
A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism. The implementation only validates if the target path is literally / and does not canonicalize the path. An attacker or ac…
- CVE-2025-12838HIGHCVSS 7.3EG 7.32025-12-23
MSP360 Free Backup Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MSP360 Free Backup. An attacker must first obtain the ability to exec…
- CVE-2025-46637HIGHCVSS 7.3EG 7.32025-12-09
Dell Encryption, versions prior to 11.12.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A local malicious user could potentially exploit this vulnerability, leading to Elevation of privileges.
- CVE-2025-55247HIGHCVSS 7.3EG 7.32025-10-14
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
- CVE-2025-8612HIGHCVSS 7.3EG 7.32025-08-20
AOMEI Backupper Workstation Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of AOMEI Backupper Workstation. An attacker must first obtain t…
- CVE-2025-5296HIGHCVSS 7.3EG 7.32025-08-18
CWE-59: Improper Link Resolution Before File Access ('Link Following') vulnerability exists that could cause arbitrary data to be written to protected locations, potentially leading to escalation of privilege, arbitrary file corruption, …
- CVE-2025-36611HIGHCVSS 7.3EG 7.32025-07-30
Dell Encryption and Dell Security Management Server, versions prior to 11.11.0, contain an Improper Link Resolution Before File Access ('Link Following') Vulnerability. A local malicious user could potentially exploit this vulnerability, l…
- CVE-2025-49680HIGHCVSS 7.3EG 7.32025-07-08
Improper link resolution before file access ('link following') in Windows Performance Recorder allows an authorized attacker to deny service locally.
- CVE-2025-53109HIGHCVSS 7.3EG 7.32025-07-02
Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versions of Filesystem prior to 0.6.4 or 2025.7.01 could allow access to unintended files via symlinks within allowed directo…
- CVE-2025-32721HIGHCVSS 7.3EG 7.32025-06-10
Improper link resolution before file access ('link following') in Windows Recovery Driver allows an authorized attacker to elevate privileges locally.
- CVE-2025-5474HIGHCVSS 7.3EG 7.32025-06-06
2BrightSparks SyncBackFree Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of 2BrightSparks SyncBackFree. An attacker must first obtain the…
- CVE-2025-4211HIGHCVSS 7.3EG 7.32025-05-16
Improper Link Resolution Before File Access ('Link Following') vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows Symlink Attacks and the use of Malicious Files. Issue originates from CVE-2024-3…
- CVE-2025-21331HIGHCVSS 7.3EG 7.32025-01-14
Windows Installer Elevation of Privilege Vulnerability
- CVE-2024-12753HIGHCVSS 7.3EG 7.32024-12-30
Foxit PDF Reader Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PDF Reader. An attacker must first obtain the ability to execute …
- CVE-2024-49107HIGHCVSS 7.3EG 7.32024-12-12
WmsRepair Service Elevation of Privilege Vulnerability
- CVE-2024-22038HIGHCVSS 7.3EG 7.32024-11-28
Various problems in obs-scm-bridge allows attackers that create specially crafted git repositories to leak information of cause denial of service.
- CVE-2024-51721HIGHCVSS 7.3EG 7.32024-11-12
A code injection vulnerability in the SecuSUITE Server Web Administration Portal of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially inject script commands or other executable content into the server that would…
- CVE-2024-43470HIGHCVSS 7.3EG 7.32024-09-10
Azure Network Watcher VM Agent Elevation of Privilege Vulnerability
- CVE-2024-38081HIGHCVSS 7.3EG 7.32024-07-09
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
- CVE-2024-30093HIGHCVSS 7.3EG 7.32024-06-11
Windows Storage Elevation of Privilege Vulnerability
- CVE-2024-26216HIGHCVSS 7.3EG 7.32024-04-09
Windows File Server Resource Management Service Elevation of Privilege Vulnerability
- CVE-2024-29007HIGHCVSS 7.3EG 7.32024-04-04
The CloudStack management server and secondary storage VM could be tricked into making requests to restricted or random resources by means of following 301 HTTP redirects presented by external servers when downloading templates or ISOs. Us…
- CVE-2023-41969HIGHCVSS 7.3EG 7.32024-03-26
An arbitrary file deletion in ZSATrayManager where it protects the temporary encrypted ZApp issue reporting file from the unprivileged end user access and modification. Fixed version: Win ZApp 4.3.0 and later.
- CVE-2024-21329HIGHCVSS 7.3EG 7.32024-02-13
Azure Connected Machine Agent Elevation of Privilege Vulnerability
- CVE-2023-35624HIGHCVSS 7.3EG 7.32023-12-12
Azure Connected Machine Agent Elevation of Privilege Vulnerability
- CVE-2022-38604HIGHCVSS 7.3EG 7.32023-04-11
Wacom Driver 6.3.46-1 for Windows and lower was discovered to contain an arbitrary file deletion vulnerability.
- CVE-2022-40143HIGHCVSS 7.3EG 7.32022-09-19
A link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service servers could allow a local attacker to abuse an insecure directory that could allow a low-privileged user to run arbit…
- CVE-2022-27883HIGHCVSS 7.3EG 7.32022-04-09
A link following vulnerability in Trend Micro Antivirus for Mac 11.5 could allow an attacker to create a specially-crafted file as a symlink that can lead to privilege escalation. Please note that an attacker must at least have low-level p…
- CVE-2021-32555HIGHCVSS 7.3EG 7.32021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg-hwe-18.04 package apport hooks, it could expose private data to other local users.
- CVE-2021-32554HIGHCVSS 7.3EG 7.32021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the xorg package apport hooks, it could expose private data to other local users.
- CVE-2021-32553HIGHCVSS 7.3EG 7.32021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-17 package apport hooks, it could expose private data to other local users.
- CVE-2021-32552HIGHCVSS 7.3EG 7.32021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users.
- CVE-2021-32551HIGHCVSS 7.3EG 7.32021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-15 package apport hooks, it could expose private data to other local users.
- CVE-2021-32550HIGHCVSS 7.3EG 7.32021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-14 package apport hooks, it could expose private data to other local users.
- CVE-2021-32549HIGHCVSS 7.3EG 7.32021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-13 package apport hooks, it could expose private data to other local users.
- CVE-2021-32548HIGHCVSS 7.3EG 7.32021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-8 package apport hooks, it could expose private data to other local users.
- CVE-2021-32547HIGHCVSS 7.3EG 7.32021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-lts package apport hooks, it could expose private data to other local users.
- CVE-2019-1317HIGHCVSS 7.3EG 7.32019-10-10
A denial of service vulnerability exists when Windows improperly handles hard links, aka 'Microsoft Windows Denial of Service Vulnerability'.
- CVE-2016-9595HIGHCVSS 7.3EG 7.32018-07-27
A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary …
- CVE-2025-32817HIGHCVSS 6.1EG 7.32025-04-16
A Improper Link Resolution vulnerability (CWE-59) in the SonicWall Connect Tunnel Windows (32 and 64 bit) client, this results in unauthorized file overwrite, potentially leading to denial of service or file corruption.
- CVE-2014-6407HIGHCVSS v2 7.5EG 7.32014-12-12
Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.
- CVE-2026-115708HIGHCVSS 7.2EG 7.22026-10-29
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Att…
- CVE-2026-90464HIGHCVSS 7.2EG 7.22026-10-27
An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, …
Map vulnerabilities like CWE-59 to your infrastructure
EchelonGraph correlates every CVE — across CWE-59 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →