CWE-59: insecure temporary file
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Also known as Improper Link Resolution Before File Access, Zip Slip, Link Following.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- isaacs node-tar, tar, red hat cryostat 4 +20 more +22 morenode-tar: Hardlink Path Traversal via Drive-Relative Linkpath8.2 High
openclawnpmOpenClaw: Hardlink alias checks could bypass workspace-only file boundaries in specific configurations7.6 HighopenclawnpmOpenClaw has agent avatar symlink traversal in gateway session metadata6.9 Medium- openclawOpenClaw < 2026.2.24 - Sandbox Bind Validation Bypass via Symlink-Parent Missing-Leaf Paths6.9 Medium
openclawnpmOpenClaw: Zip extraction symlink traversal could write outside destination7.1 HighopenclawnpmOpenClaw: Sandbox media fallback tmp symlink alias bypass allows host file reads outside sandboxRoot7.8 High- openclawOpenClaw < 2026.3.2 - Arbitrary File Write via ZIP Extraction Parent Symlink Race Condition5.8 Medium
- openclawOpenClaw < 2026.3.2 - Path Confinement Bypass in Browser Output and File Write Operations4.8 Medium
- openclawOpenClaw < 2026.3.2 - Symlink Traversal in stageSandboxMedia Destination6.9 Medium
- dell optimizerDell Optimizer, versions prior to 6.3.1, contain an Improper Link Resolution Before File Access (...7.3 High
- openclawOpenClaw < 2026.2.25 - Time-of-Check-Time-of-Use via Mutable Symlink in system.run cwd Parameter5.9 Medium
- bentomlBentoML has an Arbitrary File Write via Symlink Path Traversal in Tar Extraction8.6 High
- openclawOpenClaw < 2026.2.22 - Symlink Traversal in Avatar Handling6.8 Medium
- wisecleaner wise force deleterAn issue in the WiseDelfile64.sys component of WiseCleaner Wise Force Deleter 7.3.2 and earlier...7.1 High
- openclawOpenClaw < 2026.2.26 - Approval Bypass via Parent Symlink Current Working Directory Rebind6.9 Medium
- openclawOpenClaw < 2026.2.25 - Symlink Traversal in agents.files Methods8.7 High
- openclawOpenClaw < 2026.2.22 - Arbitrary File Read via Symlink Following in Static File Handler4.8 Medium
- openclawOpenClaw < 2026.2.25 - Symlink Traversal in Browser Trace/Download Path Handling5.9 Medium
openclawnpmOpenClaw: Sandbox media TOCTOU could read files outside sandbox root8.7 HighopenclawnpmOpenClaw's TOCTOU symlink race in writeFileWithinRoot could create or truncate files outside root boundaries8.7 High- google androidIn multiple locations, there is a possible way to delete media without the...8.4 High
- zedSymlink Escape in Agent File Tools7.1 High
- tencent pcmanagerA privilege escalation (PE) vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on...7.4 High
- tencent ioaA privilege escalation (PE) vulnerability in the Tencent iOA app thru 210.9.28693.621001 on...7.4 High
- rustdesk client for windowsRustDesk Client for Windows Transfer File Link Following Information Disclosure Vulnerability5.5 Medium
- softland fbackupSoftland FBackup Backup/Restore HID.dll link following8.5 High
- intego personal backupIntego Personal Backup Task File Privilege Escalation8.5 High
- apple macosThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe...7.8 High
- qnap qts, quts hero +1 moreQTS, QuTS hero9.2 Critical
- microsoft windows app for mac, windows app +1 moreWindows App for Mac Installer Elevation of Privilege Vulnerability4.7 Medium
- fortinet forticlient, forticlientwindows +1 moreAn Improper Link Resolution Before File Access ('Link Following') vulnerability [CWE-59]...6.4 Medium
- tanium end-user-cxTanium addressed an arbitrary file deletion vulnerability in end-user-cx.5.5 Medium
- tanium eussTanium addressed an arbitrary file deletion vulnerability in Tanium EUSS.5.5 Medium
- tanium patch endpoint tools, endpoint configuration toolset solution +1 moreTanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.7.8 High
- tanium end-user notifications endpoint tools, end-user notifications +1 moreTanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools.5.1 Medium
- tanium patch endpoint toolsTanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.7.8 High
- dell display and peripheral manager (windows)Dell Display and Peripheral Manager (Windows) versions prior to 2.2 contain an Improper Link...6.6 Medium
- tanium engageTanium addressed a local privilege escalation vulnerability in Engage.6.6 Medium
- enforceTanium addressed an improper link resolution before file access vulnerability in Enforce.5.0 Medium
- node-modules compressingCompressing Vulnerable to Arbitrary File Write via Symlink Extraction8.4 High
- zspace q2c firmwareThe ZSPACE Q2C NAS contains a vulnerability related to incorrect symbolic link following....6.1 Medium
- yottamaster dm200 firmware, dm2 firmware, dm3 firmware +2 moreAn Incorrect Symlink Follow vulnerability exists in multiple Yottamaster NAS devices, including...6.1 Medium
- orico cd3510 firmwareThe ORICO NAS CD3510 (version V1.9.12 and below) contains an Incorrect Symlink Follow...6.1 Medium
- tp-link systems inc. vx800v v1.0, tp-link vx800v firmware +1 moreRead-Only Root Access via USB Storage Device in TP-Link VX800v5.1 Medium
- tp-link systems inc. vx800v v1.0, tp-link vx800v firmware +1 moreAccess to System Files via SFTP on TP-Link VX800v6.9 Medium
- teamviewer dex, digital employee experience +1 morePrivilege escalation in TeamViewer DEX via DeleteFileByPath instruction5.7 Medium
- isaacs node-tar, tar, red hat cryostat 4 +27 more +29 morenode-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal8.2 High
- pnpmpnpm has symlink traversal in file:/git dependencies6.7 Medium
- svenstaro miniserveminiserve affected by a TOCTOU and symlink race vulnerability6.8 Medium
- opencryptokiopenCryptoki has improper link resolution before file access (link following)6.8 Medium
- Show moreLoading…