CWE-59— Improper Link Resolution Before File Access (Link Following)

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.— MITRE CWE catalog

1,914 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-59page 31 of 39

CVE-2019-11879MEDIUMCVSS 5.5EG 5.5
2019-05-10
The WEBrick gem 1.4.2 for Ruby allows directory traversal if the attacker once had local access to create a symlink to a location outside of the web root directory. NOTE: The vendor states that this is analogous to Options FollowSymlinks i…
CVE-2014-4150MEDIUMCVSS 5.5EG 5.5
2018-07-20
The scheme48-send-definition function in cmuscheme48.el in Scheme 48 allows local users to write to arbitrary files via a symlink attack on /tmp/s48lose.tmp.
CVE-2014-0243MEDIUMCVSS 5.5EG 5.5
2018-07-19
Check_MK through 1.2.5i2p1 allows local users to read arbitrary files via a symlink attack to a file in /var/lib/check_mk_agent/job.
CVE-2018-4112MEDIUMCVSS 5.5EG 5.5
2018-04-03
An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "ATS" component. It allows attackers to obtain sensitive information by leveraging symlink mishandling.
CVE-2014-2312MEDIUMCVSS 5.5EG 5.5
2018-03-26
The main function in android_main.cpp in thermald allows local users to write to arbitrary files via a symlink attack on /tmp/thermald.pid.
CVE-2017-18188MEDIUMCVSS 5.5EG 5.5
2018-02-14
OpenRC opentmpfiles through 0.1.3, when the fs.protected_hardlinks sysctl is turned off, allows local users to obtain ownership of arbitrary files by creating a hard link inside a directory on which "chown -R" will be run.
CVE-2017-15111MEDIUMCVSS 5.5EG 5.5
2018-01-20
keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link.
CVE-2014-4996MEDIUMCVSS 5.5EG 5.5
2018-01-10
lib/vlad/dba/mysql.rb in the VladTheEnterprising gem 0.2 for Ruby allows local users to write to arbitrary files via a symlink attack on /tmp/my.cnf.#{target_host}.
CVE-2014-5509MEDIUMCVSS 5.5EG 5.5
2018-01-08
clipedit in the Clipboard module for Perl allows local users to delete arbitrary files via a symlink attack on /tmp/clipedit$$.
CVE-2014-1859MEDIUMCVSS 5.5EG 5.5
2018-01-08
(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.
CVE-2014-4978MEDIUMCVSS 5.5EG 5.5
2017-12-29
The rs_filter_graph function in librawstudio/rs-filter.c in rawstudio might allow local users to truncate arbitrary files via a symlink attack on (1) /tmp/rs-filter-graph.png or (2) /tmp/rs-filter-graph.
CVE-2017-16611MEDIUMCVSS 5.5EG 5.5
2017-12-01
In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files.
CVE-2017-8806MEDIUMCVSS 5.5EG 5.5
2017-11-13
The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handled symbolic links in…
CVE-2011-2684MEDIUMCVSS 5.5EG 5.5
2017-10-23
foo2zjs before 20110722dfsg-3ubuntu1 as packaged in Ubuntu, 20110722dfsg-1 as packaged in Debian unstable, and 20090908dfsg-5.1+squeeze0 as packaged in Debian squeeze create temporary files insecurely, which allows local users to write ove…
CVE-2017-1301MEDIUMCVSS 5.5EG 5.5
2017-10-05
IBM Spectrum Protect 7.1 and 8.1 could allow a local attacker to launch a symlink attack. IBM Spectrum Protect Backup-archive Client creates temporary files insecurely. A local attacker could exploit this vulnerability by creating a symbol…
CVE-2015-3211MEDIUMCVSS 5.5EG 5.5
2017-08-25
php-fpm allows local users to write to or create arbitrary files via a symlink attack.
CVE-2015-3156MEDIUMCVSS 5.5EG 5.5
2017-08-11
The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, write_config function in trove/guestagent/datas…
CVE-2015-3149MEDIUMCVSS 5.5EG 5.5
2017-07-25
The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symlink attack.
CVE-2015-8326MEDIUMCVSS 5.5EG 5.5
2017-06-07
The IPTables-Parse module before 1.6 for Perl allows local users to write to arbitrary files owned by the current user.
CVE-2016-10374MEDIUMCVSS 5.5EG 5.5
2017-05-17
perltidy through 20160302, as used by perlcritic, check-all-the-things, and other software, relies on the current working directory for certain output files and does not have a symlink-attack protection mechanism, which allows local users …
CVE-2017-7418MEDIUMCVSS 5.5EG 5.5
2017-04-04
ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the AllowChrootSymlinks configuration option, but checks only the last path component when enforcing AllowC…
CVE-2017-2390MEDIUMCVSS 5.5EG 5.5
2017-04-02
An issue was discovered in certain Apple products. iOS before 10.3 is affected. macOS before 10.12.4 is affected. tvOS before 10.2 is affected. watchOS before 3.2 is affected. The issue involves symlink mishandling in the "libarchive" comp…
CVE-2016-7619MEDIUMCVSS 5.5EG 5.5
2017-02-20
An issue was discovered in certain Apple products. iOS before 10.2 is affected. macOS before 10.12.2 is affected. watchOS before 3.1.3 is affected. The issue involves the "libarchive" component, which allows local users to write to arbitra…
CVE-2016-4679MEDIUMCVSS 5.5EG 5.5
2017-02-20
An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the "libarchive" component, which allows r…
CVE-2008-4996MEDIUMCVSS 5.5EG 5.5
2008-11-07
init in initramfs-tools 0.92f allows local users to overwrite arbitrary files via a symlink attack on the /tmp/initramfs.debug temporary file. NOTE: the vendor disputes this vulnerability, stating that "init is [used in] a single-user con…
CVE-2005-1916MEDIUMCVSS 5.5EG 5.5
2005-07-06
linki.py in ekg 2005-06-05 and earlier allows local users to overwrite or create arbitrary files via a symlink attack on temporary files.
CVE-2005-1879MEDIUMCVSS 5.5EG 5.5
2005-06-09
LutelWall 0.97 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file created by a system call to wget.
CVE-2005-1880MEDIUMCVSS 5.5EG 5.5
2005-06-06
everybuddy 0.4.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file created by a system call to wget.
CVE-2005-0824MEDIUMCVSS 5.5EG 5.5
2005-05-02
The internal_dump function in Mathopd before 1.5p5, and 1.6x before 1.6b6 BETA, when Mathopd is running with the -n option, allows local users to overwrite arbitrary files via a symlink attack on dump files that are triggered by a SIGWINCH…
CVE-2004-1901MEDIUMCVSS 5.5EG 5.5
2004-12-31
Portage before 2.0.50-r3 allows local users to overwrite arbitrary files via a hard link attack on the lockfiles.
CVE-2004-1603MEDIUMCVSS 5.5EG 5.5
2004-10-18
cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled.
CVE-2003-0517MEDIUMCVSS 5.5EG 5.5
2003-08-18
faxrunqd.in in mgetty 1.1.28 and earlier allows local users to overwrite files via a symlink attack on JOB files.
CVE-2002-0725MEDIUMCVSS 5.5EG 5.5
2002-09-05
NTFS file system in Windows NT 4.0 and Windows 2000 SP2 allows local attackers to hide file usage activities via a hard link to the target file, which causes the link to be recorded in the audit trail instead of the target file.
CVE-2002-0793MEDIUMCVSS 5.5EG 5.5
2002-08-12
Hard link and possibly symbolic link following vulnerabilities in QNX RTOS 4.25 (aka QNX4) allow local users to overwrite arbitrary files via (1) the -f argument to the monitor utility, (2) the -d argument to dumper, (3) the -c argument to…
CVE-2001-1494MEDIUMCVSS 5.5EG 5.5
2001-12-31
script command in the util-linux package before 2.11n allows local users to overwrite arbitrary files by setting a hardlink from the typescript log file to any file on the system, then having root execute the script command.
CVE-2000-1178MEDIUMCVSS 5.5EG 5.5
2001-01-09
Joe text editor follows symbolic links when creating a rescue copy called DEADJOE during an abnormal exit, which allows local users to overwrite the files of other users whose joe session crashes.
CVE-2000-0972MEDIUMCVSS 5.5EG 5.5
2000-12-19
HP-UX 11.00 crontab allows local users to read arbitrary files via the -e option by creating a symlink to the target file during the crontab session, quitting the session, and reading the error messages that crontab generates.
CVE-1999-1386MEDIUMCVSS 5.5EG 5.5
1999-12-31
Perl 5.004_04 and earlier follows symbolic links when running with the -e option, which allows local users to overwrite arbitrary files via a symlink attack on the /tmp/perl-eaXXXXX file.
CVE-1999-0783MEDIUMCVSS 5.5EG 5.5
1998-06-16
FreeBSD allows local users to conduct a denial of service by creating a hard link from a device special file to a file on an NFS file system.
CVE-2024-52522MEDIUMCVSS 5.4EG 5.5
2024-11-15
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indi…
CVE-2019-18901MEDIUMCVSS 5.1EG 5.5
2020-03-02
A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows local attackers to change the permissions of arbitrary f…
CVE-2020-8095MEDIUMCVSS 4.9EG 5.5
2020-01-30
A vulnerability in the improper handling of junctions before deletion in Bitdefender Total Security 2020 can allow an attacker to to trigger a denial of service on the affected device.
CVE-2018-19637MEDIUMCVSS 2.8EG 5.5
2019-03-05
Supportutils, before version 3.1-5.7.1, wrote data to static file /tmp/supp_log, allowing local attackers to overwrite files on systems without symlink protection
CVE-2018-17955MEDIUMCVSS 2.2EG 5.5
2019-03-15
In yast2-multipath before version 4.1.1 a static temporary filename allows local attackers to overwrite files on systems without symlink protection
CVE-2025-11190MEDIUMCVSS 5.4EG 5.4
2025-10-10
The Kiwire Captive Portal contains an open redirection issue via the login-url parameter, allowing an attacker to redirect users to an attacker controlled website.
CVE-2024-45418MEDIUMCVSS 5.4EG 5.4
2025-02-25
Symlink following in the installer for some Zoom apps for macOS before version 6.1.5 may allow an authenticated user to conduct an escalation of privilege via network access.
CVE-2026-120066MEDIUMCVSS 5.3EG 5.3
2026-11-02
On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links wh…
CVE-2026-119364MEDIUMCVSS 5.3EG 5.3
2026-10-30
ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. Attackers can place a symlink in a writable dir…
CVE-2026-112914MEDIUMCVSS 5.3EG 5.3
2026-10-20
filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after moving it aside, allowing another local user with rename access in a non-sticky lock directory to swap i…
CVE-2026-86469MEDIUMCVSS 5.3EG 5.3
2026-09-07
A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or…

Map vulnerabilities like CWE-59 to your infrastructure

EchelonGraph correlates every CVE — across CWE-59 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →