CWE-59— Improper Link Resolution Before File Access (Link Following)
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.— MITRE CWE catalog
1,471 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →
CVEs classified under CWE-59page 18 of 30
- CVE-2022-25856HIGHCVSS 7.5EG 7.52022-06-17
The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the (g *GitArtifactReader).Read() API in git.go. This could allow arbitrary file reads if the GitArtifactReader is provided…
- CVE-2022-26456MEDIUMCVSS 4.4EG 4.42022-09-06
In vow, there is a possible information disclosure due to a symbolic link following. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06…
- CVE-2022-26612CRITICALCVSS 9.8EG 9.82022-04-07
In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an exte…
- CVE-2022-26659HIGHCVSS 7.1EG 7.12022-03-25
Docker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any administrator writable files by creating a symlink in place of where the installer writes its log file. Starting from version 4.6.0, the Docke…
- CVE-2022-26688MEDIUMCVSS 4.4EG 4.42022-05-26
An issue in the handling of symlinks was addressed with improved validation. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. A malicious app with root privileges may be able to modify th…
- CVE-2022-26704HIGHCVSS 7.8EG 7.82022-05-26
A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.4. An app may be able to gain elevated privileges.
- CVE-2022-27815HIGHCVSS 7.8EG 7.82022-03-30
SWHKD 1.1.5 unsafely uses the /tmp/swhkd.pid pathname. There can be an information leak or denial of service.
- CVE-2022-27816HIGHCVSS 7.1EG 7.12022-03-30
SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. There can be data loss or a denial of service.
- CVE-2022-27883HIGHCVSS 7.3EG 7.32022-04-09
A link following vulnerability in Trend Micro Antivirus for Mac 11.5 could allow an attacker to create a specially-crafted file as a symlink that can lead to privilege escalation. Please note that an attacker must at least have low-level p…
- CVE-2022-28225HIGHCVSS 7.8EG 7.82022-06-15
Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.684 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating symlinks to installation file during Yandex B…
- CVE-2022-2897HIGHCVSS 7.8EG 7.82022-08-31
Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow privilege escalation..
- CVE-2022-2898MEDIUMCVSS 6.1EG 5.52022-08-31
Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow a denial-of-service condition.
- CVE-2022-30321HIGHCVSS 8.6EG 8.62022-05-25
go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0.
- CVE-2022-30333HIGHCVSS 7.5EG 9.0⚠ KEV2022-05-09
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
- CVE-2022-30523HIGHCVSS 7.8EG 7.82022-05-16
Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow a low privileged local attacker to delete the contents of an arbitrary folder as SYS…
- CVE-2022-30687HIGHCVSS 7.1EG 7.12022-05-27
Trend Micro Maximum Security 2022 is vulnerable to a link following vulnerability that could allow a low privileged local user to manipulate the product's secure erase feature to delete arbitrary files.
- CVE-2022-31036MEDIUMCVSS 4.3EG 4.32022-06-27
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting with v1.3.0 are vulnerable to a symlink following bug allowing a malicious user with repository write access to leak sensitive YAML …
- CVE-2022-31216HIGHCVSS 7.8EG 7.82022-06-15
Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file …
- CVE-2022-31217HIGHCVSS 7.8EG 7.82022-06-15
Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file …
- CVE-2022-31218HIGHCVSS 7.8EG 7.82022-06-15
Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file …
- CVE-2022-31219HIGHCVSS 7.3EG 7.82022-06-15
Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file …
- CVE-2022-31250HIGHCVSS 7.1EG 7.82022-07-20
A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root. This issue affects: openSUSE Tumbleweed keylime versions prior to 6.4.2-1.1.
- CVE-2022-31256HIGHCVSS 7.7EG 7.82022-10-26
A Improper Link Resolution Before File Access ('Link Following') vulnerability in a script called by the sendmail systemd service of openSUSE Factory allows local attackers to escalate from user mail to root. This issue affects: SUSE openS…
- CVE-2022-31258HIGHCVSS 8.2EG 6.72022-05-20
In Checkmk before 1.6.0p29, 2.x before 2.0.0p25, and 2.1.x before 2.1.0b10, a site user can escalate to root by editing an OMD hook symlink.
- CVE-2022-31466HIGHCVSS 7.9EG 7.02022-05-23
Time of Check - Time of Use (TOCTOU) vulnerability in Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, potentially leading to deletion of system files. This is achieved through exploitin…
- CVE-2022-31647HIGHCVSS 7.1EG 7.12023-04-27
Docker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 API via a symlink in the DataFolder parameter, a different vulnerability than CVE-2022-26659.
- CVE-2022-32450HIGHCVSS 7.1EG 7.12022-07-18
AnyDesk 7.0.9 allows a local user to gain SYSTEM privileges via a symbolic link because the user can write to their own %APPDATA% folder (used for ad.trace and chat) but the product runs as SYSTEM when writing chat-room data there.
- CVE-2022-32905HIGHCVSS 7.8EG 7.82022-11-01
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Ventura 13. Processing a maliciously crafted DMG file may lead to arbitrary code execution with system privileges.
- CVE-2022-34008HIGHCVSS 7.8EG 7.82022-06-21
Comodo Antivirus 12.2.2.8012 has a quarantine flaw that allows privilege escalation. To escalate privilege, a low-privileged attacker can use an NTFS directory junction to restore a malicious DLL from quarantine into the System32 folder.
- CVE-2022-34292HIGHCVSS 7.1EG 7.12023-04-27
Docker Desktop for Windows before 4.6.0 allows attackers to overwrite any file through a symlink attack on the hyperv/create dockerBackendV2 API by controlling the DataFolder parameter for DockerDesktop.vhdx, a similar issue to CVE-2022-31…
- CVE-2022-34893HIGHCVSS 7.8EG 7.82022-09-19
Trend Micro Security 2022 (consumer) has a link following vulnerability where an attacker with lower privileges could manipulate a mountpoint which could lead to escalation of privilege on an affected machine.
- CVE-2022-34960CRITICALCVSS 9.8EG 9.82022-08-25
The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve to locations on the host device. This allows the attacker to mount any arbitrary file to any location o…
- CVE-2022-35631MEDIUMCVSS 5.5EG 5.52022-07-29
On MacOS and Linux, it may be possible to perform a symlink attack by replacing this predictable file name with a symlink to another file and have the Velociraptor client overwrite the other file. This issue was resolved in Velociraptor 0.…
- CVE-2022-3592MEDIUMCVSS 6.5EG 6.52023-01-12
A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under …
- CVE-2022-36113MEDIUMCVSS 4.6EG 4.62022-09-14
Cargo is a package manager for the rust programming language. After a package is downloaded, Cargo extracts its source code in the ~/.cargo folder on disk, making it available to the Rust projects it builds. To record when an extraction is…
- CVE-2022-36336HIGHCVSS 7.8EG 7.82022-07-30
A link following vulnerability in the scanning function of Trend Micro Apex One and Worry-Free Business Security agents could allow a local attacker to escalate privileges on affected installations. The resolution for this issue has been d…
- CVE-2022-36943HIGHCVSS 8.1EG 8.12023-01-03
SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a syml…
- CVE-2022-38482MEDIUMCVSS 4.3EG 4.32023-01-10
A link-manipulation issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP4.
- CVE-2022-38604HIGHCVSS 7.3EG 7.32023-04-11
Wacom Driver 6.3.46-1 for Windows and lower was discovered to contain an arbitrary file deletion vulnerability.
- CVE-2022-38699MEDIUMCVSS 5.9EG 5.92022-09-28
Armoury Crate Service’s logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrar…
- CVE-2022-38730MEDIUMCVSS 6.3EG 6.32023-04-27
Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start dockerBackendV2 API by controlling the data-root field inside the DaemonJSON field in the WindowsContainerStartRequest class. …
- CVE-2022-39215HIGHCVSS 8.3EG 8.32022-09-15
Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possible to display directory listings outside of the defined `fs` scope. This require…
- CVE-2022-39253MEDIUMCVSS 5.5EG 5.52022-10-19
Git is an open source, scalable, distributed revision control system. Versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4 are subject to exposure of sensitive information to a malicious actor. When performi…
- CVE-2022-40143HIGHCVSS 7.3EG 7.32022-09-19
A link following local privilege escalation vulnerability in Trend Micro Apex One and Trend Micro Apex One as a Service servers could allow a local attacker to abuse an insecure directory that could allow a low-privileged user to run arbit…
- CVE-2022-40710HIGHCVSS 7.8EG 7.82022-09-28
A link following vulnerability in Trend Micro Deep Security 20 and Cloud One - Workload Security Agent for Windows could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain th…
- CVE-2022-4122MEDIUMCVSS 5.3EG 5.32022-12-08
A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure.
- CVE-2022-41973HIGHCVSS 7.8EG 7.82022-10-29
multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink hand…
- CVE-2022-42291HIGHCVSS 8.2EG 5.52023-02-07
NVIDIA GeForce Experience contains a vulnerability in the installer, where a user installing the NVIDIA GeForce Experience software may inadvertently delete data from a linked location, which may lead to data tampering. An attacker does n…
- CVE-2022-42292MEDIUMCVSS 5.0EG 7.82023-02-12
NVIDIA GeForce Experience contains a vulnerability in the NVContainer component, where a user without administrator privileges can create a symbolic link to a file that requires elevated privileges to write to or modify, which may lead to…
- CVE-2022-42725HIGHCVSS 7.5EG 7.52022-10-10
Warpinator through 1.2.14 allows access outside of an intended directory, as demonstrated by symbolic directory links.
Map vulnerabilities like CWE-59 to your infrastructure
EchelonGraph correlates every CVE — across CWE-59 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.
Start Free Scan →