CWE-59: insecure temporary file
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Also known as Improper Link Resolution Before File Access, Zip Slip, Link Following.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- backstage@backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain Bypass6.3 Medium
- backstage, red hat developer hub 1.8, developer hub 1.9 +2 moreBackstage has a Possible Symlink Path Traversal in Scaffolder Actions7.1 High
- lenovo vantageAn improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo...6.8 Medium
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows server 2025 +3 more +5 moreHost Process for Windows Tasks Elevation of Privilege Vulnerability7.8 High
- pypa virtualenvvirtualenv Has TOCTOU Vulnerabilities in Directory Creation4.5 Medium
- tox-dev filelockfilelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock5.3 Medium
- qnap systems inc. qfinder pro mac, qsync for mac, qvpn device client for mac +2 moreQfinder Pro, Qsync, QVPN4.4 Medium
- msp360 free backupMSP360 Free Backup Link Following Local Privilege Escalation Vulnerability7.3 High
- zillya total securityZillya Total Security 3.0.2367.0 Local Privilege Escalation via Quarantine Module8.5 High
- weblateWeblate has an arbitrary file read via symbolic links7.7 High
- tox-dev filelockfilelock has TOCTOU race condition that allows symlink attacks during lock file creation6.3 Medium
- ugreen dh2100+Ugreen DH2100+ USB symlink7.0 High
- apple macosThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS Tahoe...5.5 Medium
- apple macosThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe...5.5 Medium
- bitdefender total security, antivirus, antivirus plus +2 more +4 moreLocal Privilege Escalation via Arbitrary File Operation in Bitdefender Total Security8.8 High
- dell encryptionDell Encryption, versions prior to 11.12.1, contain an Improper Link Resolution Before File...6.6 Medium
- dell encryptionDell Encryption, versions prior to 11.12.1, contain an Improper Link Resolution Before File...7.3 High
- argoproj argo-workflows, argo workflows +1 moreargoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links8.1 High
- static-web-server static web server, static-web-server +1 moreStatic Web Server is vulnerable to symbolic link Path Traversal5.5 Medium
- acustica-audio aquariusAquarius Desktop 3.0.069 for macOS contains an insecure file handling vulnerability in its...7.7 High
- jumpcloud inc. remote assistJumpCloud Remote Assist < 0.317.0 Arbitrary File Write/Delete via Insecure Temp Directory8.5 High
- microsoft windows, windows 11 version 24h2, windows 11 version 25h2 +4 more +6 moreHost Process for Windows Tasks Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreWindows Routing and Remote Access Service (RRAS) Denial of Service Vulnerability5.5 Medium
- No product listedImproper link resolution before file access ('link following') for some Intel(R) Server...5.4 Medium
- axis osThe ACAP Application framework could allow privilege escalation through a symlink attack. This...6.8 Medium
- github enterprise serverPre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation7.5 High
- revenera installshieldPotential Denial of Service in Supported Versions of Revenera InstallShield5.6 Medium
- kubevirtKubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes5.0 Medium
- apple macosThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS...5.5 Medium
- apple ipados, macos, tvos +4 more +6 moreThis issue was addressed with improved validation of symlinks. This issue is fixed in visionOS 26...5.5 Medium
- apple macosThis issue was addressed with improved validation of symlinks. This issue is fixed in macOS...5.5 Medium
- apple macosThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sonoma...5.5 Medium
- apple macosThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sonoma...3.3 Low
- apple ipados, macos, tvos +4 more +6 moreThis issue was addressed with improved validation of symlinks. This issue is fixed in visionOS 26...6.3 Medium
- razer synapse, synapse 3 +1 moreRazer Synapse 3 RazerPhilipsHueUninstall Link Following Local Privilege Escalation Vulnerability7.8 High
- razer synapse, synapse 3 +1 moreRazer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability7.8 High
- razer synapse, synapse 3 +1 moreRazer Synapse 3 Macro Module Link Following Local Privilege Escalation Vulnerability7.8 High
- ermig1979 antiduplermig1979 AntiDupl Delete Duplicate Image AntiDupl.NET.WinForms.exe link following8.5 High
- git-lfsGit LFS may write to arbitrary files via crafted symlinks8.6 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 24h2 +1 more +3 moreWindows Health and Optimized Experiences Elevation of Privilege Vulnerability7.8 High
- microsoft xbox gaming servicesXbox Gaming Services Elevation of Privilege Vulnerability7.8 High
- microsoft .net, .net 8.0, .net 9.0 +2 more.NET Elevation of Privilege Vulnerability7.3 High
- zheny-creator ytgrabber-tuiyt-grabber-tui allows arbitrary code execution via configurable yt-dlp path7.8 High
- oobabooga text-generation-webuitext-generation-webui allows arbitrary file read via symbolic link upload6.2 Medium
- asus armoury crateA link following vulnerability exists in the UnifyScanner component of Armoury Crate. This...8.5 High
- synchroweb kiwireCVE-2025-111905.4 Medium
- wonderwhy-er desktopcommandermcpwonderwhy-er DesktopCommanderMCP filesystem.ts isPathAllowed symlink2.0 Low
- aws client vpnLocal Privilege Escalation Vulnerability in AWS Client VPN macOS Client9.3 Critical
- nagios host, teamviewer full client +1 morePrivilege Escalation via Symbolic Link Spoofing in TeamViewer Client4.7 Medium
- pip maintainers pipFallback tar extraction in pip doesn't check symbolic links point to extraction directory5.9 Medium
- Show moreLoading…