CWE-61: UNIX Symbolic Link (Symlink) Following
The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
Also known as Symlink following, symlink vulnerability.
A kind of CWE-59 insecure temporary file.
From the CWE List. © The MITRE Corporation.
Newest
- debian freedombox In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack... 8.4 High
- nvm-sh nvm nvm prints the contents of any readable file through a symlinked .nvmrc 6.7 Medium
- moby buildkit Malicious client could set xattr value outside of BuildKit state directory 4.5 Medium
- nvidia slurm NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could... 4.7 Medium
- pi-hole Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink 7.8 High
- zip-rs zip2 zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically. (The defense against CVE-2025-29787 was broken in v7.2.0) 7.4 High
- red hat openshift container platform 4, openshift container platform 5 +1 more Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination 5.5 Medium
- asynchttpclient async-http-client AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink 5.8 Medium
- qnap systems inc. qumagie Import Symlink Following Remote Code Execution Vulnerability in QuMagie 9.4 Critical
- qnap systems inc. qsync central Symlink creation in qsyncsrv.cgi 5.3 Medium
- bytecodealliance wasmtime Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 Sandbox Escape via Symlink Rename 8.8 High
- denji ngx cache purge ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations... 3.6 Low
- nginxui nginx ui, 0xjacky nginx-ui +1 more Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied 8.1 High
- imagemagick ImageMagick: Policy Bypass in delegate symlink cleanup due to missing check 4.0 Medium
- red hat openshift serverless, openshift source-to-image (s2i), openshift container platform 4 +1 more +3 more Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction 6.4 Medium
- anthropic @anthropic-ai/claude-code Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code 7.7 High
- @backstage plugin-techdocs-node, backstage, linuxfoundation backstage plugin-techdocs-node +2 more Backstage: TechDocs arbitrary file read via mkdocs snippets 5.3 Medium
- gnupg gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive. When... 3.6 Low
- jelmer dulwich Dulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths 7.3 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 7 +5 more +7 more Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc 7.1 High
- lxc LXC: lxc-copy host-context hostname update follows symlink 6.8 Medium
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 7 +5 more +7 more Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin 7.1 High
- flatpak Important: flatpak security update 7.4 High
- flatpak flatpak: Fix of CVE-2026-96807 4.0 Medium
- red hat enterprise linux 10, enterprise linux 9 +1 more Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste 6.1 Medium
- hp linux imaging and printing, hp inc. linux imaging and printing software (hplip) +1 more HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities 5.1 Medium
- flatpak In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to... 7.4 High
- nltk NLTK before 3.10.3 Hardlink File Overwrite via downloader 6.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 more Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink 5.5 Medium
- dell cyber recovery, powerprotect cyber recovery, power protect cyber recovery +2 more Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink)... 5.8 Medium
- ilya-zlobintsev lact Predictable temporary file in /tmp allows symlink attack in LACT 6.9 Medium
- runtipi Runtipi: Authenticated arbitrary file write via backup restore symlink planting 6.5 Medium
- lxc incus Incus vulnerable to root RCE via image backup.yaml symlink 9.9 Critical
- nixos nix Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature 2.8 Low
- bytecodealliance wasmtime Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 Sandbox Escape via Trailing Slashes 8.8 High
- dell appsync, metro node, powerflex intelligent catalog +6 more +8 more Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1, Dell... 7.3 High
- rsyncproject rsync rsync < 3.5.0 Arbitrary File Read via Symlink Following 8.4 High
- smarty-php smarty Smarty: Symlink path traversal out of trusted directories 6.9 Medium
- termux proot-distro `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive 8.2 High
-
skilocrates.io skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source 6.5 Medium - cribl stream Authenticated RCE via Symlink Following in Cribl Stream Pack Git Import 8.7 High
- dji spark perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink 5.3 Medium
- huggingface datasets Datasets Symlink-following Arbitrary File Write via Extractor.extract() 4.4 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 more Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys 7.3 High
- go standard library os, golang go +1 more Root escape via symlink plus trailing slash in os 7.8 High
- ocaml opam In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed... 5.7 Medium
- suse opensuse tumbleweed LPE from suricata user to root due to chown in %post in suricata packaging 7.1 High
- zcaceres markdownify-mcp zcaceres markdownify-mcp Markdownify.ts assertPathAllowed symlink 4.8 Medium
- snowflake cli Snowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path Restriction 6.3 Medium
- max-mapper extract-zip extract-zip unvalidated symlink path traversal 8.6 High
- Show olderLoading…