CWE-59— Improper Link Resolution Before File Access (Link Following)
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.— MITRE CWE catalog
1,914 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-59page 34 of 39
- CVE-2014-1934MEDIUMCVSS v2 3.3EG 4.52014-05-08
tag.py in eyeD3 (aka python-eyed3) 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack on a temporary file.
- CVE-2026-122136MEDIUMCVSS 4.4EG 4.42026-11-04
Powerlevel10k before 1.20.19 contains a symlink following vulnerability in _p9k_dump_instant_prompt that allows local attackers to overwrite victim-writable files via a predictable temporary path. Attackers can pre-plant symlinks at p10k-i…
- CVE-2026-64672MEDIUMCVSS 4.4EG 4.42026-10-15
Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shar…
- CVE-2026-105081MEDIUMCVSS 4.4EG 4.42026-10-12
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create…
- CVE-2026-108751MEDIUMCVSS 4.4EG 4.42026-10-11
MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to overwrite files outside the project via a symlinked .moai-tmp staging path. Attackers can co…
- CVE-2026-106566MEDIUMCVSS 4.4EG 4.42026-10-07
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICK_SHRED_PASSES environment variable, allowing a local privileged workflow to…
- CVE-2026-79699MEDIUMCVSS 4.4EG 4.42026-09-15
A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by stor…
- CVE-2026-0291MEDIUMCVSS 4.4EG 4.42026-08-13
An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Ac…
- CVE-2026-18508MEDIUMCVSS 4.4EG 4.42026-08-03
A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archiv…
- CVE-2026-16130MEDIUMCVSS 4.4EG 4.42026-07-18
A vulnerability was identified in nearai ironclaw up to 0.29.1. The affected element is the function validate_path of the file src/tools/builtin/path_utils.rs of the component write_file. The manipulation leads to link following. Local acc…
- CVE-2026-46468MEDIUMCVSS 4.4EG 4.42026-07-03
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper link r…
- CVE-2026-44269MEDIUMCVSS 4.4EG 4.42026-07-03
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper link r…
- CVE-2026-7397MEDIUMCVSS 4.4EG 4.42026-04-29
A security flaw has been discovered in NousResearch hermes-agent 0.8.0. This affects the function _check_sensitive_path of the file tools/file_tools.py. The manipulation results in symlink following. Attacking locally is a requirement. The…
- CVE-2025-53594MEDIUMCVSS 4.4EG 4.42026-01-02
A path traversal vulnerability has been reported to affect several product versions. If a local attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have alread…
- CVE-2025-24136MEDIUMCVSS 4.4EG 4.42025-01-27
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. A malicious app may be able to create symlinks to protected regions of the disk.
- CVE-2024-52542MEDIUMCVSS 4.4EG 4.42024-12-17
Dell AppSync, version 4.6.0.x, contain a Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information tampering.
- CVE-2023-20004MEDIUMCVSS 4.4EG 4.42024-11-15
Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local file system of an affected device. These vulnerabilities are due to improper acc…
- CVE-2024-45770MEDIUMCVSS 4.4EG 4.42024-09-19
A vulnerability was found in Performance Co-Pilot (PCP). This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. U…
- CVE-2024-35253MEDIUMCVSS 4.4EG 4.42024-06-11
Microsoft Azure File Sync Elevation of Privilege Vulnerability
- CVE-2024-35235MEDIUMCVSS 4.4EG 4.42024-06-11
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.8 and earlier, when starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd proc…
- CVE-2022-45440MEDIUMCVSS 4.4EG 4.42023-01-17
A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0, which processes symbolic links on external storage media. A local authenticated attacker with administrator privileges could abuse this vuln…
- CVE-2022-26456MEDIUMCVSS 4.4EG 4.42022-09-06
In vow, there is a possible information disclosure due to a symbolic link following. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06…
- CVE-2022-26688MEDIUMCVSS 4.4EG 4.42022-05-26
An issue in the handling of symlinks was addressed with improved validation. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. A malicious app with root privileges may be able to modify th…
- CVE-2022-20103MEDIUMCVSS 4.4EG 4.42022-05-03
In aee daemon, there is a possible information disclosure due to symbolic link following. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: A…
- CVE-2020-15401MEDIUMCVSS 4.4EG 4.42020-06-30
IOBit Malware Fighter Pro 8.0.2.547 allows local users to gain privileges for file deletion by manipulating malicious flagged file locations with an NTFS junction and an Object Manager symbolic link.
- CVE-2020-3835MEDIUMCVSS 4.4EG 4.42020-02-27
A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Catalina 10.15.3. A malicious application may be able to access restricted files.
- CVE-2019-11230MEDIUMCVSS 4.4EG 4.42019-07-18
In Avast Antivirus before 19.4, a local administrator can trick the product into renaming arbitrary files by replacing the Logs\Update.log file with a symlink. The next time the product attempts to write to the log file, the target of the …
- CVE-2018-1063MEDIUMCVSS 4.4EG 4.42018-03-02
Context relabeling of filesystems is vulnerable to symbolic link attack, allowing a local, unprivileged malicious entity to change the SELinux context of an arbitrary file to a context with few restrictions. This only happens when the rela…
- CVE-2014-4038MEDIUMCVSS v2 4.4EG 4.42014-06-17
ppc64-diag 2.6.1 allows local users to overwrite arbitrary files via a symlink attack related to (1) rtas_errd/diag_support.c and /tmp/get_dt_files, (2) scripts/ppc64_diag_mkrsrc and /tmp/diagSEsnap/snapH.tar.gz, or (3) lpd/test/lpd_ela_te…
- CVE-2013-4215MEDIUMCVSS v2 4.4EG 4.42014-05-05
The IPXPING_COMMAND in contrib/check_ipxping.c in Nagios Plugins 1.4.16 allows local users to gain privileges via a symlink attack on /tmp/ipxping/ipxping.
- CVE-2014-1876MEDIUMCVSS v2 4.4EG 4.42014-02-10
The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log f…
- CVE-2013-4136MEDIUMCVSS v2 4.4EG 4.42013-09-30
ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /t…
- CVE-2011-2185MEDIUMCVSS v2 4.4EG 4.42011-07-27
Fabric before 1.1.0 allows local users to overwrite arbitrary files via a symlink attack on (1) a /tmp/fab.*.tar file or (2) certain other files in the top level of /tmp/.
- CVE-2011-0754MEDIUMCVSS v2 4.4EG 4.42011-02-02
The SplFileInfo::getType function in the Standard PHP Library (SPL) extension in PHP before 5.3.4 on Windows does not properly detect symbolic links, which might make it easier for local users to conduct symlink attacks by leveraging cross…
- CVE-2010-0788MEDIUMCVSS v2 4.4EG 4.42010-03-02
ncpfs 2.2.6 allows local users to cause a denial of service, obtain sensitive information, or possibly gain privileges via symlink attacks involving the (1) ncpmount and (2) ncpumount programs.
- CVE-2010-0787MEDIUMCVSS v2 4.4EG 4.42010-03-02
client/mount.cifs.c in mount.cifs in smbfs in Samba 3.0.22, 3.0.28a, 3.2.3, 3.3.2, 3.4.0, and 3.4.5 allows local users to mount a CIFS share on an arbitrary mountpoint, and gain privileges, via a symlink attack on the mountpoint directory …
- CVE-2009-4135MEDIUMCVSS v2 4.4EG 4.42009-12-11
The distcheck rule in dist-check.mk in GNU coreutils 5.2.1 through 8.1 allows local users to gain privileges via a symlink attack on a file in a directory tree under /tmp.
- CVE-2009-4030MEDIUMCVSS v2 4.4EG 4.42009-11-30
MySQL 5.1.x before 5.1.41 allows local users to bypass certain privilege checks by calling CREATE TABLE on a MyISAM table with modified (1) DATA DIRECTORY or (2) INDEX DIRECTORY arguments that are originally associated with pathnames witho…
- CVE-2009-1297MEDIUMCVSS v2 4.4EG 4.42009-10-23
iscsi_discovery in open-iscsi in SUSE openSUSE 10.3 through 11.1 and SUSE Linux Enterprise (SLE) 10 SP2 and 11, and other operating systems, allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary f…
- CVE-2009-1962MEDIUMCVSS v2 4.4EG 4.42009-06-08
Xfig, possibly 3.2.5, allows local users to read and write arbitrary files via a symlink attack on the (1) xfig-eps[PID], (2) xfig-pic[PID].pix, (3) xfig-pic[PID].err, (4) xfig-pcx[PID].pix, (5) xfig-xfigrc[PID], (6) xfig[PID], (7) xfig-pr…
- CVE-2009-1253MEDIUMCVSS v2 4.4EG 4.42009-04-09
James Stone Tunapie 2.1 allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file.
- CVE-2008-6397MEDIUMCVSS v2 4.4EG 4.42009-03-04
rlatex in AlcoveBook sgml2x 1.0.0 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
- CVE-2008-5256MEDIUMCVSS v2 4.4EG 4.42008-11-27
The AcquireDaemonLock function in ipcdUnix.cpp in Sun Innotek VirtualBox before 2.0.6 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/.vbox-$USER-ipc/lock temporary file.
- CVE-2008-4190MEDIUMCVSS v2 4.4EG 4.42008-09-24
The IPSEC livetest tool in Openswan 2.4.12 and earlier, and 2.6.x through 2.6.16, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the (1) ipseclive.conn and (2) ipsec.olts.remote.log tempo…
- CVE-2008-4085MEDIUMCVSS v2 4.4EG 4.42008-09-15
plaiter in Plait before 1.6 allows local users to overwrite arbitrary files via a symlink attack on (1) cut.$$, (2) head.$$, (3) awk.$$, and (4) ps.$$ temporary files in /tmp/.
- CVE-2007-5495MEDIUMCVSS v2 4.4EG 4.42008-05-23
sealert in setroubleshoot 2.0.5 allows local users to overwrite arbitrary files via a symlink attack on the sealert.log temporary file.
- CVE-2008-2266MEDIUMCVSS v2 4.4EG 4.42008-05-16
uulib/uunconc.c in UUDeview 0.5.20, as used in nzbget before 0.3.0 and possibly other products, allows local users to overwrite arbitrary files via a symlink attack on a temporary filename generated by the tempnam function. NOTE: this may…
- CVE-2008-0163MEDIUMCVSS v2 4.4EG 4.42008-02-12
Linux kernel 2.6, when using vservers, allows local users to access resources of other vservers via a symlink attack in /proc.
- CVE-2007-3916MEDIUMCVSS v2 4.4EG 4.42007-09-24
The main function in skkdic-expr.c in SKK Tools 1.2 allows local users to overwrite or delete arbitrary files via a symlink attack on a skkdic$PID temporary file.
- CVE-2007-4652MEDIUMCVSS v2 4.4EG 4.42007-09-04
The session extension in PHP before 5.2.4 might allow local users to bypass open_basedir restrictions via a session file that is a symlink.
Map vulnerabilities like CWE-59 to your infrastructure
EchelonGraph correlates every CVE — across CWE-59 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Book a Demo →