CWE-59— Improper Link Resolution Before File Access (Link Following)

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.— MITRE CWE catalog

1,914 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-59page 23 of 39

CVE-2026-90930MEDIUMCVSS 6.8EG 6.8
2026-09-14
File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-deni…
CVE-2026-59311MEDIUMCVSS 6.8EG 6.8
2026-08-27
A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Int…
CVE-2026-18267MEDIUMCVSS 6.8EG 6.8
2026-08-20
Kenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Kenwood DNR1007XR devices. Authentication is not r…
CVE-2026-2808MEDIUMCVSS 6.8EG 6.8
2026-03-11
HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when configured with Kubernetes authentication. This vulnerability, CVE-2026-2808, is fixed in Consul 1.18.21, 1.21.11 and 1.22.5.
CVE-2025-67124MEDIUMCVSS 6.8EG 6.8
2026-01-23
A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outside the intended upload/document root in deployments where the attacker can creat…
CVE-2026-23893MEDIUMCVSS 6.8EG 6.8
2026-01-22
openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to symlink-following when running in privileged contexts. A token-group user can redirect file operations to arbitrary filesy…
CVE-2025-5718MEDIUMCVSS 6.8EG 6.8
2025-11-11
The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacke…
CVE-2024-30076MEDIUMCVSS 6.8EG 6.8
2024-06-11
Windows Container Manager Service Elevation of Privilege Vulnerability
CVE-2023-28972MEDIUMCVSS 6.8EG 6.8
2023-04-17
An Improper Link Resolution Before File Access vulnerability in console port access of Juniper Networks Junos OS on NFX Series allows an attacker to bypass console access controls. When "set system ports console insecure" is enabled, root …
CVE-2023-27850MEDIUMCVSS 6.8EG 6.8
2023-03-10
NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a file sharing mechanism that allows users with access to this feature to access arbitrary files on the device.
CVE-2021-20153MEDIUMCVSS 6.8EG 6.8
2021-12-30
Trendnet AC2600 TEW-827DRU version 2.08B01 contains a symlink vulnerability in the bittorrent functionality. If enabled, the bittorrent functionality is vulnerable to a symlink attack that could lead to remote code execution on the device.…
CVE-2019-3690MEDIUMCVSS 6.8EG 6.8
2019-12-05
The chkstat tool in the permissions package followed symlinks before commit a9e1d26cd49ef9ee0c2060c859321128a6dd4230 (please also check the additional hardenings after this fix). This allowed local attackers with control over a path that i…
CVE-2019-12672MEDIUMCVSS 6.8EG 6.8
2019-09-25
A vulnerability in the filesystem of Cisco IOS XE Software could allow an authenticated, local attacker with physical access to an affected device to execute arbitrary code on the underlying operating system (OS) with root privileges. The …
CVE-2013-0248MEDIUMCVSS 6.8EG 6.8
2013-03-15
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
CVE-2026-45491MEDIUMCVSS 5.5EG 6.8
2026-06-09
Improper link resolution before file access ('link following') in .NET allows an unauthorized attacker to perform tampering locally.
CVE-2011-0402MEDIUMCVSS v2 6.8EG 6.8
2011-01-11
dpkg-source in dpkg before 1.14.31 and 1.15.x allows user-assisted remote attackers to modify arbitrary files via a symlink attack on unspecified files in the .pc directory.
CVE-2009-0473MEDIUMCVSS v2 6.8EG 6.8
2009-02-06
Open redirect vulnerability in the web interface in the Rockwell Automation ControlLogix 1756-ENBT/A EtherNet/IP Bridge Module allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified ve…
CVE-2007-2978MEDIUMCVSS v2 6.8EG 6.8
2007-06-01
Session fixation vulnerability in eggblog 3.1.0 and earlier allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
CVE-2005-2714MEDIUMCVSS v2 6.8EG 6.8
2005-12-31
passwd in Directory Services in Mac OS X 10.3.x before 10.3.9 and 10.4.x before 10.4.5 allows local users to overwrite arbitrary files via a symlink attack on the .pwtmp.[PID] temporary file.
CVE-2026-70165MEDIUMCVSS 6.7EG 6.7
2026-10-13
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-107578MEDIUMCVSS 6.7EG 6.7
2026-10-08
Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in Progressive Robot hMailServer 6.3.4 and 6.3.5 allow a local attacker who already runs code as the low-privilege…
CVE-2026-65680MEDIUMCVSS 6.7EG 6.7
2026-08-11
Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized attacker to elevate privileges locally.
CVE-2026-40977MEDIUMCVSS 6.7EG 6.7
2026-04-28
When an application is configured to use `ApplicationPidFileWriter`, a local attacker with write access to the PID file's location can corrupt one file on the host each time the application is started. Affected: Spring Boot 4.0.0–4.0.5 …
CVE-2025-24918MEDIUMCVSS 6.7EG 6.7
2025-11-11
Improper link resolution before file access ('link following') for some Intel(R) Server Configuration Utility software and Intel(R) Server Firmware Update Utility software before version 16.0.12. within Ring 3: User Applications may allow …
CVE-2025-43726MEDIUMCVSS 6.7EG 6.7
2025-09-02
Dell Alienware Command Center 5.x (AWCC), versions prior to 5.10.2.0, contains an Improper Link Resolution Before File Access ('Link Following')" vulnerability. A low privileged attacker with local access could potentially exploit this vul…
CVE-2025-29983MEDIUMCVSS 6.7EG 6.7
2025-04-15
Dell Trusted Device, versions prior to 7.0.3.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to E…
CVE-2023-43078MEDIUMCVSS 6.7EG 6.7
2024-08-28
Dell Dock Firmware and Dell Client Platform contain an Improper Link Resolution vulnerability during installation resulting in arbitrary folder deletion, which could lead to Privilege Escalation or Denial of Service.
CVE-2024-38013MEDIUMCVSS 6.7EG 6.7
2024-07-09
Microsoft Windows Server Backup Elevation of Privilege Vulnerability
CVE-2024-5742MEDIUMCVSS 6.7EG 6.7
2024-06-12
A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a…
CVE-2024-31952MEDIUMCVSS 6.7EG 6.7
2024-05-14
An issue was discovered in Samsung Magician 8.0.0 on macOS. Because symlinks are used during the installation process, an attacker can escalate privileges via arbitrary file permission writes. (The attacker must already have user privilege…
CVE-2023-28065MEDIUMCVSS 6.7EG 6.7
2023-06-23
Dell Command | Update, Dell Update, and Alienware Update versions 4.8.0 and prior contain an Insecure Operation on Windows Junction / Mount Point vulnerability. A local malicious user could potentially exploit this vulnerability leading t…
CVE-2023-28141MEDIUMCVSS 6.7EG 6.7
2023-04-18
An NTFS Junction condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.8.0.31. Attackers may write files to arbitrary locations via a local attack vector. This allows attackers to assume the privileges of th…
CVE-2009-1142MEDIUMCVSS 6.7EG 6.7
2022-11-23
An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can gain privileges via a symlink attack on /tmp files if vmware-user-suid-wrapper is setuid root and the ChmodChownDirectory function is enabled.
CVE-2022-21770MEDIUMCVSS 6.7EG 6.7
2022-07-06
In sound driver, there is a possible information disclosure due to symlink following. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS0…
CVE-2021-42056MEDIUMCVSS 6.7EG 6.7
2022-06-24
Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a local attacker, through a symlink attack, to overwrite arbitrary files, and potentially achieve arbitr…
CVE-2022-20085MEDIUMCVSS 6.7EG 6.7
2022-05-03
In netdiag, there is a possible symbolic link following due to an improper link resolution. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID…
CVE-2022-20068MEDIUMCVSS 6.7EG 6.7
2022-04-11
In mobile_log_d, there is a possible symbolic link following due to an improper link resolution. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Pat…
CVE-2022-20050MEDIUMCVSS 6.7EG 6.7
2022-03-10
In connsyslogger, there is a possible symbolic link following due to improper link resolution. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch…
CVE-2020-10665MEDIUMCVSS 6.7EG 6.7
2020-03-18
Docker Desktop allows local privilege escalation to NT AUTHORITY\SYSTEM because it mishandles the collection of diagnostics with Administrator privileges, leading to arbitrary DACL permissions overwrites and arbitrary file writes. This aff…
CVE-2018-1634MEDIUMCVSS 6.7EG 6.7
2019-08-20
IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in infos.DBSERVERNAME. IBM X-Force ID: 144437.
CVE-2018-1633MEDIUMCVSS 6.7EG 6.7
2019-08-20
IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in onsrvapd. IBM X-Force ID: 144434.
CVE-2018-1632MEDIUMCVSS 6.7EG 6.7
2019-08-20
IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in .infxdirs. IBM X-Force ID: 144432.
CVE-2018-1631MEDIUMCVSS 6.7EG 6.7
2019-08-20
IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in oninit mongohash. IBM X-Force ID: 144431.
CVE-2018-1630MEDIUMCVSS 6.7EG 6.7
2019-08-20
IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user logged in with database administrator user to gain root privileges through a symbolic link vulnerability in onmode. IBM X-Force ID: 144430.
CVE-2017-12172MEDIUMCVSS 6.7EG 6.7
2017-11-22
PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs under a non-root operating system account, and database superusers have effective ability to run a…
CVE-2017-9525MEDIUMCVSS 6.7EG 6.7
2017-06-09
In the cron package through 3.0pl1-128 on Debian, and through 3.0pl1-128ubuntu2 on Ubuntu, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod…
CVE-2017-15097MEDIUMCVSS 6.5EG 6.7
2018-07-27
Privilege escalation flaws were found in the Red Hat initialization scripts of PostgreSQL. An attacker with access to the postgres user account could use these flaws to obtain root access on the server machine.
CVE-2026-111802MEDIUMCVSS 6.6EG 6.6
2026-10-16
A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this f…
CVE-2026-81310MEDIUMCVSS 6.6EG 6.6
2026-09-30
Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is installed may overwrite arbitrary files by using a special method in advance.
CVE-2026-85092MEDIUMCVSS 6.6EG 6.6
2026-09-03
LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker wh…

Map vulnerabilities like CWE-59 to your infrastructure

EchelonGraph correlates every CVE — across CWE-59 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →