CWE-59: insecure temporary file
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Also known as Improper Link Resolution Before File Access, Zip Slip, Link Following.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Information Disclosure Vulnerability7.4 High
- gitea open source git serverGitea template repository generation mishandles symlinked paths9.1 Critical
- dell powerprotect data domain, data domain operating system +1 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0...4.9 Medium
- dell powerprotect data domain, data domain operating system +1 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0...4.4 Medium
- dell powerprotect data domain, data domain operating system +1 moreDell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0...4.4 Medium
- oras-project oras-gooras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction7.1 High
land.oras:oras-java-sdkMavenland.oras:oras-java-sdk: Symlink-based path traversal in ArchiveUtils.untar / unzip allows arbitrary file write outside extraction directory0.0 None- dell device management agentDell Device Management Agent, versions prior to DDMA 26.05, contain an Improper Link Resolution...7.3 High
- onionshareOnionShare follows symlinks in shared directories, allowing unintended disclosure of local files4.8 Medium
- anthropic claude code, anthropics claude-code +1 moreClaude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution7.7 High
- attr project attr, red hat cert manager support for red hat openshift release 1.19, discovery 2 +8 more +10 moreattr < 2.6.0 Symlink Traversal Privilege Escalation via getfattr/setfattr8.4 High
- acl project acl, red hat discovery 2, enterprise linux 10 +11 more +13 moreacl < 2.4.0 Symlink Traversal Privilege Escalation via libacl Functions8.4 High
- dokkuDokku: Arbitrary File Write via Tar Symlink Traversal in git:from-archive and certs:add9.0 Critical
- anysphere cursorCursor Desktop sandbox escape via symlink and failed path canonicalization9.3 Critical
- filebrowserFile Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup8.2 High
- anthropic claude code, anthropics claude-code +1 moreClaude Code: Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Write4.4 Medium
- chromedevtools chrome-devtools-mcpchrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots6.1 Medium
- proftpdProFTPD ACL Bypass via /proc/self/root Path Prefix in RNFR8.6 High
- open source opentofuOpenTofu before 1.11.7 Symlink Following Path Traversal7.0 High
- gogsGogs: UploadRepoFiles writes outside repo working tree via committed parent sym9.0 Critical
- python software foundation cpythontarfile extraction filter bypass allows escaping the destination directory7.8 High
- nanocoai nanoclawNanoClaw < 2.1.17 - Arbitrary File Read via Symlink Following in forwardAttachedFiles6.8 Medium
- budibaseBudibase: Arbitrary file read by workspace-builder via PWA-zip symlink upload9.6 Critical
skillctlcrates.ioskillctl: argument injection, path traversal in --dest, FIFO/device DoS, hardlink exfiltration, and commit-trailer forgeryNo score- dell wyse management suite (wms), wyse management suite +1 moreDell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution...7.8 High
- pydantic pydantic-settingsNestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing secrets_dir_max_size5.3 Medium
- gunthercox chatterbotChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer5.5 Medium
- jovancoding network-aiNetwork-AI: EnvironmentManager.backup() follows symlinked directories and copies files outside the environment root into backups5.5 Medium
- qbee-io transportqbee transport: Symlink-chain path traversal in tar extraction (one level outside destination)6.0 Medium
- miurahr py7zrpy7zr: Arbitrary File Write Vulnerability8.0 High
- gohugo hugoHugo symlink confinement bypass in os.ReadFile5.9 Medium
- cloud foundry foundation bpm-releasesetupBpmLogs follows symlink for bpm.log open and chown — container-to-host privilege escalation...6.8 Medium
- kidocode crawl4aiCrawl4AI arbitrary file write via download filename path traversal9.6 Critical
- containers podmanPodman: WORKDIR symlink traversal vulnerability5.3 Medium
- microsoft .net, .net 10.0 runtime, .net 8.0 runtime +6 more +8 more.NET Tampering Vulnerability7.0 High
- black lantern security bbotSymlink-following arbitrary write via github_workflows module2.2 Low
- chromedevtools chrome-devtools-mcpchrome-devtools-mcp: daemon.pid write follows symlinks in /tmp fallback runtime directory6.1 Medium
- runtipiRuntipi: Unauthenticated arbitrary file read through app-store logo symlinks6.5 Medium
- crawl4aiCrawl4AI - Arbitrary File Write via output_path Symlink and TOCTOU9.2 Critical
- gohugo hugoHugo: Symlink confinement bypass in resources.Get6.9 Medium
- microsoft malware protection engineMicrosoft Defender Elevation of Privilege Vulnerability7.8 High
- langchain, langchain-ai langchain-anthropic +1 moreLangChain: Path traversal and sandbox escape in LangChain file-search middleware and loaders5.1 Medium
- fedoraproject fedora, red hat enterprise linux 6, enterprise linux 7 +10 more +12 moreAbrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites7.0 High
- filebrowserFile Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope7.5 High
- kitty project kittyKitty has an arbitrary file overwrite via symlink following in `kitten dnd` remote drop staging7.6 High
- kitty project kittyKitty has an Arbitrary File Write via Symlink Race Condition in File Transmission Protocol5.0 Medium
- apple macosThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia...5.5 Medium
- rikyoz bit7zbit7z: Arbitrary File Overwrite via Symlink Attack on Predictable Temp File During Archive Update6.1 Medium
- kubev2v assisted migration agentAssisted-migration-agent: vddk tarball chained-symlink arbitrary file write9.6 Critical
- debian debusineDebusine is an integrated solution to build, distribute and maintain a Debian-based distribution....6.5 Medium
- Show moreLoading…