CWE-59— Improper Link Resolution Before File Access (Link Following)
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.— MITRE CWE catalog
1,914 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-59page 30 of 39
- CVE-2024-44131MEDIUMCVSS 5.5EG 5.52024-09-17
This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to access sensitive user data.
- CVE-2024-30065MEDIUMCVSS 5.5EG 5.52024-06-11
Windows Themes Denial of Service Vulnerability
- CVE-2024-0068MEDIUMCVSS 5.5EG 5.52024-02-29
Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Workforce Access on MacOS allows File Manipulation.This issue affects Workforce Access: before 8.7.1.
- CVE-2023-51654MEDIUMCVSS 5.5EG 5.52023-12-26
Improper link resolution before file access ('Link Following') issue exists in iPrint&Scan Desktop for Windows versions 11.0.0 and earlier. A symlink attack by a malicious user may cause a Denial-of-service (DoS) condition on the PC.
- CVE-2023-41968MEDIUMCVSS 5.5EG 5.52023-09-27
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13.6, tvOS 17, macOS Monterey 12.7, watchOS 10, iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to read arbitrary files.
- CVE-2023-32556MEDIUMCVSS 5.5EG 5.52023-06-26
A link following vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to disclose sensitive information. Please note: an attacker must first obtain the ability to execute low-privileged …
- CVE-2023-24577MEDIUMCVSS 5.5EG 5.52023-03-13
McAfee Total Protection prior to 16.0.50 allows attackers to elevate user privileges due to Improper Link Resolution via registry keys. This could enable a user with lower privileges to execute unauthorized tasks.
- CVE-2022-22582MEDIUMCVSS 5.5EG 5.52023-02-27
A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in Security Update 2022-003 Catalina, macOS Big Sur 11.6.5, macOS Monterey 12.3. A local user may be…
- CVE-2023-22490MEDIUMCVSS 5.5EG 5.52023-02-14
Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even wh…
- CVE-2022-39253MEDIUMCVSS 5.5EG 5.52022-10-19
Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performi…
- CVE-2022-0029MEDIUMCVSS 5.5EG 5.52022-09-14
An improper link resolution vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local attacker to read files on the system with elevated privileges when generating a tech support file.
- CVE-2022-35631MEDIUMCVSS 5.5EG 5.52022-07-29
On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client overwrite the other file. This issue was resolved in Velociraptor 0.…
- CVE-2021-23521MEDIUMCVSS 5.5EG 5.52022-01-31
This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is crafted with an entry containing a symbolic link. When extracted, the symbolic link is followed outside of the target di…
- CVE-2021-1612MEDIUMCVSS 5.5EG 5.52021-09-23
A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated, local attacker to overwrite arbitrary files on the local system. This vulnerability is due to improper access controls on files within the local file sys…
- CVE-2021-30968MEDIUMCVSS 5.5EG 5.52021-08-24
A validation issue related to hard link behavior was addressed with improved sandbox restrictions. This issue is fixed in macOS Big Sur 11.6.2, tvOS 15.2, macOS Monterey 12.1, Security Update 2021-008 Catalina, iOS 15.2 and iPadOS 15.2, wa…
- CVE-2021-30855MEDIUMCVSS 5.5EG 5.52021-08-24
A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in Security Update 2021-005 Catalina, iOS 14.8 and iPadOS 14.8, iOS 15 and iPadOS 15, watchOS 8, mac…
- CVE-2021-27851MEDIUMCVSS 5.5EG 5.52021-04-26
A security vulnerability that can lead to local privilege escalation has been found in ’guix-daemon’. It affects multi-user setups in which ’guix-daemon’ runs locally. The attack consists in having an unprivileged user spawn a buil…
- CVE-2021-28650MEDIUMCVSS 5.5EG 5.52021-03-17
autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex s…
- CVE-2020-4717MEDIUMCVSS 5.5EG 5.52021-03-10
A vulnerability exists in IBM SPSS Modeler Subscription Installer that allows a user with create symbolic link permission to write arbitrary file in another protected path during product installation. IBM X-Force ID: 187727.
- CVE-2021-24084MEDIUMCVSS 5.5EG 5.52021-02-25
Windows Mobile Device Management Information Disclosure Vulnerability
- CVE-2020-36241MEDIUMCVSS 5.5EG 5.52021-02-05
autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outs…
- CVE-2020-8585MEDIUMCVSS 5.5EG 5.52021-01-28
OnCommand Unified Manager Core Package versions prior to 5.2.5 may disclose sensitive account information to unauthorized users via the use of PuTTY Link (plink).
- CVE-2020-28935MEDIUMCVSS 5.5EG 5.52020-12-07
NLnet Labs Unbound, up to and including version 1.12.0, and NLnet Labs NSD, up to and including version 4.3.3, contain a local vulnerability that would allow for a local symlink attack. When writing the PID file, Unbound and NSD create the…
- CVE-2020-6015MEDIUMCVSS 5.5EG 5.52020-11-05
Check Point Endpoint Security for Windows before E84.10 can reach denial of service during clean install of the client which will prevent the storage of service log files in non-standard locations.
- CVE-2018-21269MEDIUMCVSS 5.5EG 5.52020-10-27
checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal path component can be a symlink.
- CVE-2017-18925MEDIUMCVSS 5.5EG 5.52020-10-26
opentmpfiles through 0.3.1 allows local users to take ownership of arbitrary files because d entries are mishandled and allow a symlink attack.
- CVE-2020-25289MEDIUMCVSS 5.5EG 5.52020-09-13
The VPN service in AVAST SecureLine before 5.6.4982.470 allows local users to write to arbitrary files via an Object Manager symbolic link from the log directory (which has weak permissions).
- CVE-2020-7325MEDIUMCVSS 5.5EG 5.52020-09-09
Privilege Escalation vulnerability in McAfee MVISION Endpoint prior to 20.9 Update allows local users to access files which the user otherwise would not have access to via manipulating symbolic links to redirect McAfee file operations to a…
- CVE-2020-24332MEDIUMCVSS 5.5EG 5.52020-08-13
An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the creation of the system.data file is prone to symlink attacks. The tss user can be used to create or corrupt existing files, which c…
- CVE-2020-0779MEDIUMCVSS 5.5EG 5.52020-03-12
An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0798, CVE-2020-0814, CVE-20…
- CVE-2012-6114MEDIUMCVSS 5.5EG 5.52020-01-28
The git-changelog utility in git-extras 1.7.0 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/changelog or (2) /tmp/.git-effort.
- CVE-2020-0616MEDIUMCVSS 5.5EG 5.52020-01-14
A denial of service vulnerability exists when Windows improperly handles hard links, aka 'Microsoft Windows Denial of Service Vulnerability'.
- CVE-2019-8789MEDIUMCVSS 5.5EG 5.52019-12-18
A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1. Parsing a maliciously crafted iBooks file may l…
- CVE-2019-8568MEDIUMCVSS 5.5EG 5.52019-12-18
A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A local user may be able to modify prot…
- CVE-2013-4184MEDIUMCVSS 5.5EG 5.52019-12-10
Perl module Data::UUID from CPAN version 1.219 vulnerable to symlink attacks
- CVE-2019-3750MEDIUMCVSS 5.5EG 5.52019-12-03
Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability. A local authenticated malicious user with low privileges potentially could exploit this vulnerability to delete arbitrary files by creating a symli…
- CVE-2019-3749MEDIUMCVSS 5.5EG 5.52019-12-03
Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability. A local authenticated malicious user with low privileges potentially could exploit this vulnerability to delete arbitrary files by creating a symli…
- CVE-2019-17445MEDIUMCVSS 5.5EG 5.52019-11-22
An issue was discovered in Eracent EDA, EPA, EPM, EUA, FLW, and SUM Agent through 10.2.26. The agent executable, when installed for non-root operations (scanning), can be forced to copy files from the filesystem to other locations via Symb…
- CVE-2014-1938MEDIUMCVSS 5.5EG 5.52019-11-21
python-rply before 0.7.4 insecurely creates temporary files.
- CVE-2011-2924MEDIUMCVSS 5.5EG 5.52019-11-19
foomatic-rip filter v4.0.12 and prior used insecurely creates temporary files for storage of PostScript data by rendering the data when the debug mode was enabled. This flaw may be exploited by a local attacker to conduct symlink attacks b…
- CVE-2011-2923MEDIUMCVSS 5.5EG 5.52019-11-19
foomatic-rip filter, all versions, used insecurely creates temporary files for storage of PostScript data by rendering the data when the debug mode was enabled. This flaw may be exploited by a local attacker to conduct symlink attacks by o…
- CVE-2010-4817MEDIUMCVSS 5.5EG 5.52019-11-13
pithos before 0.3.5 allows overwrite of arbitrary files via symlinks.
- CVE-2011-5271MEDIUMCVSS 5.5EG 5.52019-11-12
Pacemaker before 1.1.6 configure script creates temporary files insecurely
- CVE-2009-0035MEDIUMCVSS 5.5EG 5.52019-11-09
alsa-utils 1.0.19 and later versions allows local users to overwrite arbitrary files via a symlink attack via the /usr/bin/alsa-info and /usr/bin/alsa-info.sh scripts.
- CVE-2019-18645MEDIUMCVSS 5.5EG 5.52019-10-31
The quarantine restoration function in Total Defense Anti-virus 11.5.2.28 is vulnerable to symbolic link attacks, allowing files to be written to privileged directories.
- CVE-2019-18466MEDIUMCVSS 5.5EG 5.52019-10-28
An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during a copy operation from the container to the host, because an undesired glob operation occurs. An attacker could create a container im…
- CVE-2019-1270MEDIUMCVSS 5.5EG 5.52019-09-11
An elevation of privilege vulnerability exists in Windows store installer where WindowsApps directory is vulnerable to symbolic link attack, aka 'Microsoft Windows Store Installer Elevation of Privilege Vulnerability'.
- CVE-2019-1074MEDIUMCVSS 5.5EG 5.52019-07-15
An elevation of privilege vulnerability exists in Microsoft Windows where certain folders, with local service privilege, are vulnerable to symbolic link attack. An attacker who successfully exploited this vulnerability could potentially ac…
- CVE-2019-13229MEDIUMCVSS 5.5EG 5.52019-07-04
deepin-clone before 1.1.3 uses a fixed path /tmp/partclone.log in the Helper::getPartitionSizeInfo() function to write a log file as root, and follows symlinks there. An unprivileged user can prepare a symlink attack there to create or ove…
- CVE-2019-13227MEDIUMCVSS 5.5EG 5.52019-07-04
In GUI mode, deepin-clone before 1.1.3 creates a log file at the fixed path /tmp/.deepin-clone.log as root, and follows symlinks there. An unprivileged user can prepare a symlink attack there to create or overwrite files in arbitrary file …
Map vulnerabilities like CWE-59 to your infrastructure
EchelonGraph correlates every CVE — across CWE-59 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →