CWE-59: insecure temporary file
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Also known as Improper Link Resolution Before File Access, Zip Slip, Link Following.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- imagemagickImageMagick before 7.1.2-30 Path Policy TOCTOU Symlink Race1.0 Low
- siyuan-note siyuanSiYuan before v3.8.2 Path Traversal via symlink in file API7.1 High
- jtsylve limeLiME through 1.12.0 Arbitrary File Overwrite via Symlink Following5.2 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 8 +11 more +13 moreBubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup8.8 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +3 more +5 moreUtil-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks7.0 High
pnpmnpmpnpm: pacquet trust-lockfile install can create dependency symlinks outside the project7.1 High- elastic winlogbeat, security +1 moreImproper Link Resolution Before File Access ('Link Following') in Winlogbeat Leading to Arbitrary File Write and Denial of Service7.2 High
- backblaze clientBackblaze Client for Windows Improper Link Resolution Vulnerability5.8 Medium
- aquaproj aquaaqua: Archive extraction in aqua follows attacker-planted symlinks, allowing writes outside the install directory6.6 Medium
- kubevelaKubeVela Terraform remote loader DoS via unbounded file read8.5 High
- gitoxidelabs gitoxidegitoxide before 0.33.0 Path Traversal via symlink following6.0 Medium
- composerComposer: CVE-2026-59946 fix bypass via symlinked package bin path6.1 Medium
- spring integration, vmware spring integration +1 moreFixed predictable /tmp/ziptransformer work directory enables symlink pre-creation6.8 Medium
- nltkNLTK before 3.10.3 Hardlink File Overwrite via downloader6.9 Medium
- nltkNLTK through 3.10.3 Path Traversal via Model-Artifact APIs8.3 High
- jahlives openssl encryptverify-usb before 1.4.9 Symlink Directory Traversal Code Execution8.7 High
- scottchiefbaker doolArbitrary File Overwrite via Symlink Following in dool project2.0 Low
- wibu-systems-ag codemeter-runtimeLocal Privilege Escalation in CodeMeter Runtime on Windows7.8 High
- webpros plesk migrator, plesk site import +1 moreImproper symlink resolution before file access in Plesk allows remote authenticated users to...8.7 High
- weblateorg weblateWeblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)7.7 High
- sonicwall netextenderThe NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender...7.0 High
- nltkNLTK before 3.10.3 Path Traversal via Symlink Bypass8.2 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreSos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write7.8 High
- getgrav gravGrav CMS before 2.0.16 Symlink Following via createLockFile8.6 High
- cthackers adm-zipadm-zip 0.5.9 through 0.6.0 Arbitrary File Overwrite via Symlink Following on Extraction6.8 Medium
- nltkNLTK before 3.9.4 Symlink Escape via CorpusReader8.6 High
- nltkNLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10.28.7 High
- nltknltk IPIPANCorpusReader Symlink Arbitrary File Read6.8 Medium
- runtipiRuntipi: Authenticated arbitrary file write via backup restore symlink planting6.5 Medium
- infracostInfracost: Arbitrary file read via config-template readFile symlink traversal5.9 Medium
- zanllp infinite-image-browsingInfinite Image Browsing Resolves Paths With normpath, Allowing Symlink Escape From Scanned Directories8.7 High
- lxc incusIncus vulnerable to root RCE via image backup.yaml symlink9.9 Critical
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.8 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS7.1 High
- ibm aix, powervm vios, vios +2 moreVulnerabilities in IBM AIX and PowerVM VIOS6.3 Medium
- kenwood dnr1007xrKenwood DNR1007XR Firmware Update Link Following Code Execution Vulnerability6.8 Medium
- dell command update, command update (dcu) +1 moreDell Command Update (DCU), versions prior to 5.7.1, contain an Improper Link Resolution Before...6.6 Medium
- confidential-containers guest-componentsConfidential Containers Guest Components image-rs: zip-slip-class arbitrary file write via absolute entry path in hardlink fallback6.4 Medium
- google chromeLink following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169...8.4 High
- moby go-archive, docker cli, compose +3 more +5 moreTar extraction in moby/go-archive can write outside the destination directory via link following7.1 High
- hmbown codewhaleCodeWhale before 0.8.64 Path Traversal via image_analyze symlink8.7 High
- max-mapper extract-zipextract-zip arbitrary file write outside the destination directory via a symlink at the final path component8.1 High
- microsoft malware protection engineMicrosoft Defender Elevation of Privilege Vulnerability7.8 High
- pax technology q80PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability7.5 High
- lenovo commercial vantage, vantage +1 moreDuring an internal security assessment, an improper link following vulnerability was identified...7.3 High
- lenovo dock managerDuring an internal security assessment, a potential vulnerability was discovered in Lenovo Dock...6.9 Medium
- lenovo vantageAn improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage...6.9 Medium
- rsyncproject rsyncrsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink9.2 Critical
- rsyncproject rsyncrsync < 3.5.0 Symlink Race Condition Directory Traversal8.2 High
- rsyncproject rsyncrsync < 3.5.0 Symlink Race Condition via --remove-source-files5.7 Medium
- Show moreLoading…