CWE-59: insecure temporary file
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Also known as Improper Link Resolution Before File Access, Zip Slip, Link Following.
A kind of CWE-706 Use of Incorrectly-Resolved Name or Reference.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft .net 10.0 runtime, .net 11.0 runtime, .net 9.0 runtime +2 more +4 more.NET Elevation of Privilege Vulnerability7.3 High
- microsoft .net 10.0 runtime, .net 11.0 runtime, .net 9.0 runtime +2 more +4 more.NET Elevation of Privilege Vulnerability6.7 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows AppX Deployment Service Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Hyper-V Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 +14 more +16 moreWindows Registry Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 +14 more +16 moreWindows Update Orchestrator Service Elevation of Privilege Vulnerability7.0 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreMicrosoft Windows Search Component Elevation of Privilege Vulnerability7.8 High
- microsoft windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 +9 more +11 moreWindows Update Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 +14 more +16 moreWindows AppX Deployment Service Information Disclosure Vulnerability4.7 Medium
- citrix uniconosLocal Privilege Escalation8.5 High
- the-40-thieves obsidian-tcobsidian-tc symlink path mismatch bypasses read ACL restrictions4.7 Medium
- oraios serenaSerena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root8.4 High
- microsoft .net 10.0 runtime, .net 11.0 runtime, .net 8.0 runtime +3 more +5 more.NET Elevation of Privilege Vulnerability7.8 High
- microsoft .net 10.0 runtime, .net 11.0 runtime, .net 8.0 runtime +3 more +5 more.NET Elevation of Privilege Vulnerability7.8 High
- gohugoio hugoHugo from v0.162.0 before v0.167.0 Symlink File Disclosure via Nested Mount Ancestor6.7 Medium
- vercel deepsecVercel deepsec before 1.1.17 Arbitrary File Write via Symlink in Sandbox Tarball Extraction4.9 Medium
- imagemagickImageMagick before 7.1.2-32 TOCTOU Symlink Race Path Policy Bypass via magick script2.0 Low
- imagemagickImageMagick before 7.1.2-33 Policy Bypass via Symlink in IsRightsAuthorizedByName2.0 Low
- thclawsthClaws through 0.141.0 Symlink Following File Write via POST /v1/inputs2.3 Low
- ericlbuehler mistral.rsmistral.rs 0.9.0 through 0.9.4 Sandbox Escape via Symlink Following in mistralrs-code-exec7.6 High
- modu-ai moai-adkMoAI-ADK through 3.1.2 Symlink Following via moai init Template Deployer4.8 Medium
- qingyuna answer-me-with-htmlanswer-me-with-html through 0.5.0 Symlink Following in Code Block src Embedding2.0 Low
- open-multi-agentopen-multi-agent 1.5.0 through 1.21.2 Sandbox Escape via file_write Dangling Symlink5.7 Medium
- pulseaiclub phiPhi 0.1.1 through 0.28.4 Symlink Workspace Write Restriction Bypass5.7 Medium
- red hat enterprise linux 6, hardened images +1 moreBusybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix6.3 Medium
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied8.1 High
- red hat migration toolkit for applications 8, migration toolkit for virtualization, openshift service mesh 3 +15 more +17 moreAnsible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution8.8 High
- masci banksBanks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry7.3 High
- intego antivirusIntego Antivirus through 3.0.0.1 Local Privilege Escalation via Optimization Module Junction8.5 High
- aws aws-cdk-libImproper link resolution in asset bundling output handling in aws-cdk-lib6.8 Medium
- progressive robot ltd hmailserverImproper Link Resolution Before File Access ('Link Following') in hMailServer6.7 Medium
- imagemagickImageMagick: Policy Bypass in delegate symlink cleanup due to missing check4.0 Medium
- openprinting cupsCUPS copy_model() creates a predictable PPD tempfile without O_EXCL/O_NOFOLLOW (symlink TOCTOU, lp → root)5.7 Medium
- @backstage plugin-techdocs-node, backstage, linuxfoundation backstage plugin-techdocs-node +2 moreBackstage: Potential file exposure through local TechDocs publisher5.3 Medium
- @backstage plugin-techdocs-node, backstage, linuxfoundation backstage plugin-techdocs-node +2 moreBackstage: TechDocs arbitrary file read via mkdocs snippets5.3 Medium
- @backstage plugin-scaffolder-backend, backstage, linuxfoundation backstage\/plugin-scaffolder-backend +2 moreBackstage: Improper task state validation in Scaffolder backend8.5 High
- @backstage plugin-scaffolder-backend-module-bitbucket-cloud, plugin-scaffolder-backend-module-bitbucket-server, backstage +2 more +4 moreBackstage: Improper filesystem validation in Bitbucket pull-request scaffolder actions8.5 High
- red hat openshift container platform 4Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass5.5 Medium
- jelmer dulwichDulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths7.3 High
- jelmer dulwichDulwich 0.23.1 before 1.2.8 Symlink Path Traversal via filter_branch Index Filter7.3 High
- jelmer dulwichDulwich 0.22.5 before 1.2.8 Path Traversal via Stash Pop Symlinks7.3 High
- foundation50 classroom50Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download)9.4 Critical
- tornadoweb tornadoTornado before 6.5.9 StaticFileHandler Path Traversal via Symlink8.2 High
- tornadoweb tornadoTornado before 6.5.9 Denial of Service via Query String6.9 Medium
- accellion kiteworks, kiteworks core +1 moreKiteworks Core Local Privilege Escalation7.8 High
- accellion kiteworks, kiteworks core +1 moreKiteworks Core before version 9.5.0 is vulnerable to Local Privilege Escalation7.8 High
- cato networks sdp clientCato Networks SDP Client for Windows is vulnerable to Local Privilege Escalation8.5 High
- pfu limited image scanner driver for linux (fi series), image scanner driver for linux (sp series) +1 moreImage Scanner Driver for Linux contains a link following vulnerability. An attacker who can log...5.2 Medium
- google mcp toolbox for databasesPath Traversal via Symlink Following in allowedLocalRoots in MCP Toolbox for Databases8.6 High
- python software foundation cpythonRace condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory5.9 Medium
- Show moreLoading…