CWE-59: insecure temporary file
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Also known as Improper Link Resolution Before File Access, Zip Slip, Link Following.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- egor data::spatialhash::sharedData::SpatialHash::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.8 Low
- egor data::intern::sharedData::Intern::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.8 Low
- egor data::ringbuffer::sharedData::RingBuffer::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.8 Low
- egor data::roaringbitmap::sharedData::RoaringBitmap::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW5.5 Medium
- egor data::hashmap::sharedData::HashMap::Shared versions before 0.14 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.8 Low
- egor data::radixtree::sharedData::RadixTree::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.8 Low
- egor data::sortedset::sharedData::SortedSet::Shared versions before 0.03 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.8 Low
- egor data::reqrep::sharedData::ReqRep::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.8 Low
- egor data::pubsub::sharedData::PubSub::Shared versions before 0.07 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.8 Low
- egor data::ndarray::sharedData::NDArray::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.3 Low
- egor data::graph::sharedData::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.3 Low
- egor data::deque::sharedData::Deque::Shared versions before 0.06 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW3.8 Low
- egor data::buffer::sharedData::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOW6.2 Medium
- moby buildkitWCOW cache mount source selector resolves NTFS junctions outside of cache root5.6 Medium
- extreme networks switch engine (exos)ExtremeXOS Privilege Escalation via Symlink Following in File Utilities8.7 High
- nearai ironclawnearai ironclaw write_file path_utils.rs validate_path link following4.8 Medium
- astrbotdevs astrbotAstrBotDevs AstrBot Filesystem Computer-Use Tool fs.py _normalize_rw_path link following4.8 Medium
- activepiecesActivepieces: Arbitrary file write in git-sync via path traversal and symlinks5.9 Medium
- canonical ubuntu 16.04 lts, ubuntu 18.04 lts, ubuntu 20.04 lts +4 more +6 moreubuntu-pro-client Local Privilege Escalation and Information Disclosure via Symlink Arbitrary File Read in collect-logs5.0 Medium
- imagemagickImageMagick before 7.1.2-26 Policy Bypass via script operation4.8 Medium
- No product listedMicrosoft AVML before 0.17.0 could follow a symlink when opening a destination output path on...7.5 High
- microsoft pc managerMicrosoft PC Manager Elevation of Privilege Vulnerability8.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +14 more +16 moreWindows Projected File System Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 24h2 +7 more +9 moreWindows Backup Service Elevation of Privilege Vulnerability7.3 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability7.1 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreUniversal Plug and Play (upnp.dll) Information Disclosure Vulnerability5.5 Medium
- microsoft pc managerMicrosoft PC Manager Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +18 more +20 moreWindows WalletService Elevation of Privilege Vulnerability7.8 High
- hmbrand dbd::fileDBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location7.7 High
- bitdefender internet security, total security +1 moreImproper link resolution before file access in Bitdefender Total Security via Link Following (VA-13681)7.0 High
- louisho5 picobotlouisho5 picobot Workspace filesystem.go GetSkill link following5.3 Medium
- mosaxiv clawletmosaxiv clawlet File Tools fs_ops.go edit_file link following4.8 Medium
- anydeskAnyDesk Screen Recording Link Following Denial-of-Service Vulnerability4.7 Medium
- anydeskAnyDesk Support Information Link Following Denial-of-Service Vulnerability4.7 Medium
- glarysoft glary utilitiesGlarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability7.3 High
- openclawOpenClaw < 2026.6.9 Symlink Following via Mirror Sync7.6 High
- dao-ailab flash-attentionFlashAttention Symlink Attack via tarfile.extractall in hopper/setup.py5.3 Medium
- imagemagickImageMagick before 7.1.2-26 Policy Bypass via APNG encoder4.8 Medium
- rclonerclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote7.5 High
- decompress project decompressdecompress before 4.2.2 allows arbitrary symlink creation during archive extraction. When...7.5 High
- decompress project decompressdecompress allows arbitrary hardlink creation during archive extraction5.5 Medium
- hashicorp toolingConsul-template is vulnerable to path redirection in writeToFile through symlink attack4.7 Medium
- hashicorp nomad, nomad enterprise +1 moreNomad vulnerable to sandbox escape in Docker task driver8.7 High
- black lantern security bbotSymlink guard bypass in unarchive module allows planting symlinks during extraction3.1 Low
- filebrowserFile Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope6.3 Medium
- zhenorzz goployGoploy: Arbitrary File Read via Path Traversal in /deploy/fileDiff allows Remote Server Compromise7.7 High
- zhenorzz goployGoploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare7.1 High
- aws resRES Auth.GetUserPrivateKey Arbitrary File Read7.1 High
- xhmikosr decompressdecompress: Archive extraction can create files and links outside the target directory9.1 Critical
- zcaceres markdownify-mcpzcaceres markdownify-mcp Markdownify.ts assertPathAllowed symlink4.8 Medium
- Show moreLoading…