CWE-59: insecure temporary file
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Also known as Improper Link Resolution Before File Access, Zip Slip, Link Following.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- vasion virtual appliance host, print application, print virtual appliance host +1 more +3 moreVasion Print (formerly PrinterLogic) Arbitrary File Write as Root via Response Path Symlink Follow8.5 High
- vasion virtual appliance host, print application, print virtual appliance host +1 more +3 moreVasion Print (formerly PrinterLogic) Local Privilege Escalation via Insecure Temporary File Handling8.5 High
- microsoft autoupdate, autoupdate for mac +1 moreMicrosoft AutoUpdate (MAU) Elevation of Privilege Vulnerability7.8 High
- microsoft xbox gaming servicesXbox Gaming Services Elevation of Privilege Vulnerability7.8 High
- roocode roo code, roocodeinc roo-code +1 moreRoo Code: Symlink-bypass of .rooignore can lead to unintended file disclosure5.5 Medium
- dell alienware command center 5.x (awcc), alienware command center +1 moreDell Alienware Command Center 5.x (AWCC), versions prior to 5.10.2.0, contains an Improper Link...6.7 Medium
- apple macosThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia...5.5 Medium
- n8nn8n has a symlink traversal vulnerability in "Read/Write File" node allows access to restricted files6.5 Medium
- aomei backupper workstationAOMEI Backupper Workstation Link Following Local Privilege Escalation Vulnerability7.3 High
- schneider electric sesuCWE-59: Improper Link Resolution Before File Access ('Link Following') vulnerability exists that...7.0 High
- hashicorp go-getter, shared library +1 moreHashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack7.5 High
- hp, inc. hp hotkey support softwareHP Hotkey Support – Escalation of Privilege8.4 High
- 7-zip7-Zip before 25.01 does not always properly handle symbolic links during extraction.3.6 Low
- dell encryption, security management server +1 moreDell Encryption and Dell Security Management Server, versions prior to 11.11.0, contain an...7.3 High
- apple macosThis issue was addressed by adding an additional prompt for user consent. This issue is fixed in...6.5 Medium
- apple ipados, macos +1 moreThis issue was addressed with improved validation of symlinks. This issue is fixed in iPadOS 17.7...9.8 Critical
- nvidia container toolkitNVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook8.5 High
- cato networks clientCato Networks Linux Client Local Privilege Escalation via Symlink8.6 High
- trend micro, inc. micro password manager, trendmicro password manager +1 moreTrend Micro Password Manager (Consumer) version 5.8.0.1327 and below is vulnerable to a Link...7.8 High
- git, apple xcode, debian linux +2 moreGit allows arbitrary code execution through broken config quoting8.1 High
- microsoft visual studio, visual studio 2015 update 3, visual studio 2017 version 15.9 (includes 15.0 - 15.8) +8 more +10 moreVisual Studio Elevation of Privilege Vulnerability8.8 High
- microsoft pc managerMicrosoft PC Manager Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +23 more +25 moreWindows Performance Recorder (WPR) Denial of Service Vulnerability7.3 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +23 more +25 moreWindows AppX Deployment Service Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +14 more +16 moreWindows Update Service Elevation of Privilege Vulnerability7.8 High
- microsoft azure service fabric, service fabric +1 moreAzure Service Fabric Runtime Elevation of Privilege Vulnerability6.0 Medium
- phoenix contact axc f 1152, axc f 2152, axc f 3152 +2 more +4 morePhoenix Contact: File access due to the replacement of a critical file used by the service security-profile8.8 High
- phoenix contact axc f 1152, axc f 2152, axc f 3152 +2 more +4 morePhoenix Contact: File access due to the replacement of a critical file used by the arp-preinit script8.8 High
- phoenix contact axc f 1152, axc f 2152, axc f 3152 +2 more +4 morePhoenix Contact: File access due to the replacement of a critical file used by the watchdog8.8 High
- modelcontextprotocol serversModel Context Protocol Servers Vulnerable to Path Validation Bypass via Prefix Matching and Symlink Handling7.3 High
- trellix system information reporterA path or symbolic link manipulation vulnerability in SIR 1.0.3 and prior versions allows an...7.2 High
- yrutschle sslhImproper Link Resolution Before File Access vulnerability in yrutschle/sslh9.3 Critical
- trend micro, inc. micro deep security, trendmicro deep security agent +1 moreA link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local...5.5 Medium
- trend micro, inc. micro deep security, trendmicro deep security agent +1 moreA link following vulnerability in the anti-malware solution portion of Trend Micro Deep Security...7.8 High
- trend micro, inc. micro deep security, trendmicro deep security agent +1 moreA link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local...7.8 High
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreA link following vulnerability in the Trend Micro Apex One Damage Cleanup Engine could allow a...7.8 High
- trend micro apex one, trend micro, inc. micro apex one, micro apex one as a service +2 moreA link following vulnerability in the Trend Micro Apex One scan engine could allow a local...7.0 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +32 more +34 moreWindows Installer Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +23 more +25 moreWindows Recovery Driver Elevation of Privilege Vulnerability7.3 High
- go standard library os, syscall, golang go +2 moreInconsistent handling of O_CREATE|O_EXCL on Unix and Windows in os in syscall5.5 Medium
- 2brightsparks syncbackfree2BrightSparks SyncBackFree Link Following Local Privilege Escalation Vulnerability7.3 High
- dell encryption, encryption admin utilities +1 moreDell Encryption Admin Utilities versions prior to 11.10.2 contain an Improper Link Resolution...7.8 High
- parallels desktop for mac, desktop +1 moreA privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop...7.8 High
- parallels desktop for mac, desktop +1 moreA privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop...7.8 High
- parallels desktop for mac, desktop +1 moreA privilege escalation vulnerability exists in the virtual machine archive restoration...7.8 High
- realtek bluetooth hci adaptorRealtek Bluetooth HCI Adaptor - Privilege Escalation8.5 High
- apple macosThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS...5.5 Medium
- microsoft edge update, edge (chromium-based) updater +1 moreMicrosoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability8.8 High
- hypr passwordlessImproper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Passwordless...5.7 Medium
- openvpn 3 linux, openvpn3linux +1 moreThe configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local...6.2 Medium
- Show moreLoading…