CWE-61: UNIX Symbolic Link (Symlink) Following
The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
Also known as Symlink following, symlink vulnerability.
A kind of CWE-59 insecure temporary file.
From the CWE List. © The MITRE Corporation.
Newest
- kubevirt, red hat openshift virtualization 4, redhat openshift virtualization +2 moreKubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher4.2 Medium
- kubevirt, red hat container native virtualization 4.12, container native virtualization 4.13 +10 more +12 moreKubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption7.3 High
- open source opentofuOpenTofu before 1.11.7 Symlink Following Path Traversal7.0 High
- gogsGogs: UploadRepoFiles writes outside repo working tree via committed parent sym9.0 Critical
- amazon web services language servers for awsArbitrary file write in Language Servers for AWS8.5 High
- rasta-mouse pwnliftpwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in...7.4 High
- gunthercox chatterbotChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer5.5 Medium
- langflowLangflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit9.6 Critical
- theonedev onedevOneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untar8.3 High
- containers podmanPodman: WORKDIR symlink traversal vulnerability5.3 Medium
- black lantern security bbotPath Traversal (Zip-Slip) in unarchive module5.3 Medium
- containerdcontainerd: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore8.2 High
- linuxfoundation runcrunc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations3.3 Low
- litespeed cpanel plugin, litespeedtech litespeed cpanel plugin, litespeed whm plugin +2 moreLiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0)...8.5 High
- apple macosThis issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia...5.5 Medium
- pdm-project pdmpdm: Project-Local State and Config Writes Follow Symlinks6.8 Medium
skillctlcrates.ioskillctl: Path traversal and symlink-follow in skillctl allow arbitrary file disclosure and deletion7.1 High- containers cruncrun follows rootfs /dev symlink while creating default devices5.1 Medium
- rust project cargoCrates in third party registries can override the cached source of other crates6.5 Medium
- docker engine, moby, mobyproject moby\/v2 +2 moreMoby: Race condition in docker cp allows bind mount redirection to host path7.2 High
- docker engine, moby, mobyproject moby\/v2 +2 moreMoby: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap6.1 Medium
- npitre cramfs-toolsnpitre cramfs-tools cramfsck.c change_file_status symlink4.6 Medium
- givanz vvvebVvveb < 1.0.8.3 Unrestricted File Upload RCE via Plugin Upload8.6 High
- postgresqlPostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice8.8 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write7.2 High
- webpros cpanel, cpanel (cloudlinux 6, centos 6), wp squared +2 moreA chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing...5.3 Medium
- tunnelblickTunnelblick arbitrary file read via symlink following in tunnelblickd6.8 Medium
- iobit advanced systemcareIObit Advanced SystemCare Service ASC.exe symlink7.3 High
- openclawOpenClaw 2026.3.22 < 2026.4.5 - Symlink Traversal in Remote Marketplace Repository Path Handling6.0 Medium
- nousresearch hermes-agentNousResearch hermes-agent file_tools.py _check_sensitive_path symlink4.8 Medium
astral-tokio-tarcrates.ioastral-tokio-tar: `unpack_in` can chmod arbitrary directories by following symlinks2.7 Low- netfoundry zrokzrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write8.7 High
- katacontainers kata containers, kata-containers, katacontainers confidential containers +3 more +5 moreKata Containers: CopyFile Policy Subversion via Symlinks8.2 High
- uutils coreutilsuutils coreutils ln Security Bypass via Improper Handling of the --no-dereference Flag5.0 Medium
- anthropic claude code, anthropics claude-code +1 moreClaude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace7.7 High
- saurabh-kumar python-dotenvpython-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback6.6 Medium
- flatpak xdg-desktop-portalFlatpak xdg-desktop-portal before 1.20.4 and 1.21.x before 1.21.1 allows any Flatpak app to trash...2.9 Low
- juniper junos, juniper networks junos os +1 moreJunos OS: A low privileged user can escalate their privileges so that they can login as root7.0 High
- nixos nixNix sandbox escape: file write via symlink at FOD `.tmp` copy destination9.0 Critical
- harttle liquidjsLiquidJS has a root restriction bypass for partial and layout loading through symlinked templates8.2 High
- flatpak, red hat enterprise linux 10, enterprise linux 10.0 extended update support +12 more +14 moreFlatpak has a complete sandbox escape leading to host file access and code execution in the host context9.3 Critical
- openclawOpenClaw < 2026.3.31 - Arbitrary File Write via Symlink Following in SSH Sandbox Tar Upload7.2 High
- linuxfoundation onnxONNX: External Data Symlink Traversal5.5 Medium
- linuxfoundation onnxONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load4.7 Medium
- dell appsyncDell AppSync, version(s) 4.6.0, contain(s) an UNIX Symbolic Link (Symlink) Following...7.3 High
- linuxfoundation onnx, red hat openshift ai (rhoai), openshift ai 2.25 +2 moreONNX: Path Traversal via Symlink8.7 High
- linuxcontainers incusIncus vulnerable to local privilege escalation through VM screenshot path4.7 Medium
- openclawOpenClaw < 2026.3.24 - Symlink Traversal via IDENTITY.md appendFile in agents.create/update6.9 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreThis issue was addressed with improved handling of symlinks. This issue is fixed in iOS 26.3 and...5.5 Medium
- alexcrichton tar-rs, tar project tar +1 moretar-rs: unpack_in can chmod arbitrary directories by following symlinks5.1 Medium
- Show moreLoading…