CWE-61— UNIX Symbolic Link (Symlink) Following

The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.— MITRE CWE catalog

186 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-61page 3 of 4

CVE-2026-7832HIGHCVSS 7.0EG 7.0
2026-05-05
A security flaw has been discovered in IObit Advanced SystemCare 19. This affects an unknown part of the file ASC.exe of the component Service. The manipulation results in symlink following. Attacking locally is a requirement. This attack …
CVE-2025-11489HIGHCVSS 7.0EG 7.0
2025-10-08
A security vulnerability has been detected in wonderwhy-er DesktopCommanderMCP up to 0.2.13. This vulnerability affects the function isPathAllowed of the file src/tools/filesystem.ts. The manipulation leads to symlink following. The attack…
CVE-2025-54867HIGHCVSS 7.0EG 7.0
2025-08-14
Youki is a container runtime written in Rust. Prior to version 0.5.5, if /proc and /sys in the rootfs are symbolic links, they can potentially be exploited to gain access to the host root filesystem. This issue has been patched in version …
CVE-2025-22480HIGHCVSS 7.0EG 7.0
2025-02-13
Dell SupportAssist OS Recovery versions prior to 5.5.13.1 contain a symbolic link attack vulnerability. A low-privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary file deletion and Elevat…
CVE-2026-62992MEDIUMCVSS 6.9EG 6.9
2026-08-07
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating t…
CVE-2025-53881MEDIUMCVSS 6.9EG 6.9
2025-10-02
A UNIX Symbolic Link (Symlink) Following vulnerability in logrotate config in the exim package allowed privilege escalation from mail user/group to root.This issue affects Tumbleweed: from ? before 4.98.2-lp156.248.1.
CVE-2026-47763MEDIUMCVSS 6.8EG 6.8
2026-06-10
pdm is a Python package and dependency manager supporting the latest PEP standards. In versions prior to 2.27.0, pdm writes several project-local state or configuration files without symlink protection. If a malicious repository places tho…
CVE-2026-65010MEDIUMCVSS 6.6EG 6.6
2026-07-23
Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redi…
CVE-2026-28684MEDIUMCVSS 6.6EG 6.6
2026-04-20
python-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local atta…
CVE-2025-14693MEDIUMCVSS 6.2EG 6.6
2025-12-15
A vulnerability has been found in Ugreen DH2100+ up to 5.3.0. This affects an unknown function of the component USB Handler. Such manipulation leads to symlink following. The attack can be executed directly on the physical device. The expl…
CVE-2026-106507MEDIUMCVSS 6.5EG 6.5
2026-10-06
Backstage is an open framework for building developer portals. Prior to 1.15.4, the @backstage/plugin-techdocs-node package is affected by techdocs arbitrary file read via mkdocs snippets. Unsafe path resolution in TechDocs source tree han…
CVE-2026-55168MEDIUMCVSS 6.5EG 6.5
2026-08-21
Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated at…
CVE-2026-53489MEDIUMCVSS 6.5EG 6.5
2026-06-19
containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a bug where the CRI plugin restores container.log from a checkpoint image without validating a symlinked path. This could result in reading an…
CVE-2026-43570MEDIUMCVSS 6.5EG 6.5
2026-05-05
OpenClaw versions 2026.3.22 before 2026.4.5 contain a symlink traversal vulnerability in remote marketplace repository path handling that allows attackers to escape the expected repository root. Attackers can exploit this by providing craf…
CVE-2026-33056MEDIUMCVSS 6.5EG 6.5
2026-03-20
tar-rs is a tar archive reading/writing library for Rust. In versions 0.4.44 and below, when unpacking a tar archive, the tar crate's unpack_dir function uses fs::metadata() to check whether a path that already exists is a directory. Becau…
CVE-2025-59829MEDIUMCVSS 6.5EG 6.5
2025-10-03
Claude Code is an agentic coding tool. Versions below 1.0.120 failed to account for symlinks when checking permission deny rules. If a user explicitly denied Claude Code access to a file and Claude Code had access to a symlink pointing to …
CVE-2025-3048MEDIUMCVSS 6.5EG 6.5
2025-03-31
After completing a build with AWS Serverless Application Model Command Line Interface (SAM CLI) which include symlinks, the content of those symlinks are copied to the cache of the local workspace as regular files or directories. As a resu…
CVE-2025-3047MEDIUMCVSS 6.5EG 6.5
2025-03-31
When running the AWS Serverless Application Model Command Line Interface (SAM CLI) build process with Docker and symlinks are included in the build files, the container environment allows a user to access privileged files on the host by le…
CVE-2022-3592MEDIUMCVSS 6.5EG 6.5
2023-01-12
A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under …
CVE-2021-32509MEDIUMCVSS 6.5EG 6.5
2021-07-07
Absolute Path Traversal vulnerability in FileviewDoc in QSAN Storage Manager allows remote authenticated attackers access arbitrary files by injecting the Symbolic Link following the Url path parameter. The referred vulnerability has been …
CVE-2021-32508MEDIUMCVSS 6.5EG 6.5
2021-07-07
Absolute Path Traversal vulnerability in FileStreaming in QSAN Storage Manager allows remote authenticated attackers access arbitrary files by injecting the Symbolic Link following the Url path parameter. The referred vulnerability has bee…
CVE-2021-1145MEDIUMCVSS 6.5EG 6.5
2021-01-13
A vulnerability in the Secure FTP (SFTP) of Cisco StarOS for Cisco ASR 5000 Series Routers could allow an authenticated, remote attacker to read arbitrary files on an affected device. To exploit this vulnerability, the attacker would need …
CVE-2019-11249MEDIUMCVSS 6.5EG 6.5
2019-08-29
The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on th…
CVE-2019-11246MEDIUMCVSS 6.5EG 6.5
2019-08-29
The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes runs tar inside the container to create a tar archive, copies it over the network, and kubectl unpacks it on th…
CVE-2026-107174MEDIUMCVSS 6.4EG 6.4
2026-10-07
A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability…
CVE-2026-13748MEDIUMCVSS 6.3EG 6.3
2026-06-29
Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowflake services. An attacker could exploit this by supplying crafted repository or p…
CVE-2026-24047MEDIUMCVSS 6.3EG 6.3
2026-01-21
Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command line interface of Backstage. Prior to version 0.1.17, the `resolveSafeChildPath`…
CVE-2025-43991MEDIUMCVSS 6.3EG 6.3
2025-10-13
SupportAssist for Home PCs versions 4.8.2 and prior and SupportAssist for Business PCs versions 4.5.3 and prior, contain an UNIX Symbolic Link (Symlink) following vulnerability. A low privileged attacker with local access to the system cou…
CVE-2024-52537MEDIUMCVSS 6.3EG 6.3
2024-12-11
Dell Client Platform Firmware Update Utility contains an Improper Link Resolution vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges.
CVE-2024-39578MEDIUMCVSS 6.3EG 6.3
2024-08-31
Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.1 contains a UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to denial of service, informatio…
CVE-2025-30485MEDIUMCVSS 6.2EG 6.2
2025-04-03
UNIX symbolic link (Symlink) following issue exists in FutureNet NXR series, VXR series and WXR series routers. Attaching to the affected product an external storage containing malicious symbolic link files, a logged-in administrative user…
CVE-2026-91202MEDIUMCVSS 6.1EG 6.1
2026-09-18
A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary f…
CVE-2026-75038MEDIUMCVSS 6.1EG 6.1
2026-08-25
UNIX symbolic link (symlink) following vulnerability in ilya-zlobintsev/LACT allows for local denial-of-service. This issue affects LACT: through 0.10.0.
CVE-2025-59825MEDIUMCVSS 6.1EG 6.1
2025-09-23
astral-tokio-tar is a tar archive reading/writing library for async Rust. In versions 0.5.3 and earlier of astral-tokio-tar, tar archives may extract outside of their intended destination directory when using the Entry::unpack_in_raw API. …
CVE-2026-1386MEDIUMCVSS 6.0EG 6.0
2026-01-23
A UNIX symbolic link following issue in the jailer component in Firecracker version v1.13.1 and earlier and 1.14.0 on Linux may allow a local host user with write access to the pre-created jailer directories to overwrite arbitrary host fi…
CVE-2024-25953MEDIUMCVSS 6.0EG 6.0
2024-03-28
Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to denial of service, informati…
CVE-2024-25952MEDIUMCVSS 6.0EG 6.0
2024-03-28
Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to denial of service, informati…
CVE-2026-57825MEDIUMCVSS 5.7EG 5.7
2026-09-09
In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.
CVE-2026-77159MEDIUMCVSS 5.5EG 5.5
2026-09-11
A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can r…
CVE-2025-43278MEDIUMCVSS 5.5EG 5.5
2026-06-11
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protected user data.
CVE-2026-31893MEDIUMCVSS 5.5EG 5.5
2026-05-05
Tunnelblick is an open source graphic user interface for OpenVPN on macOS. In versions 3.3beta26 through 9.0beta01, any local user can read arbitrary root-owned files by exploiting a symlink following vulnerability in tunnelblick-helper, r…
CVE-2026-34447MEDIUMCVSS 5.5EG 5.5
2026-04-01
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to version 1.21.0, there is a symlink traversal vulnerability in external data loading allows reading files outside the model directory. T…
CVE-2026-20694MEDIUMCVSS 5.5EG 5.5
2026-03-25
This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.4, macOS Sonoma 14.8.5, macOS Tahoe 26.3, macOS Tahoe 26.4. An app …
CVE-2026-23968MEDIUMCVSS 5.5EG 5.5
2026-01-21
Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions whi…
CVE-2025-5468MEDIUMCVSS 5.5EG 5.5
2025-08-12
Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed…
CVE-2025-43853MEDIUMCVSS 5.5EG 5.5
2025-05-15
The WebAssembly Micro Runtime's (WAMR) iwasm package is the executable binary built with WAMR VMcore which supports WebAssembly System Interface (WASI) and command line interface. Anyone running WAMR up to and including version 2.2.0 or WA…
CVE-2025-24832MEDIUMCVSS 5.5EG 5.5
2025-02-27
Arbitrary file overwrite during home directory recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.4.866, Acronis Backup plugin for cPanel & …
CVE-2024-34014MEDIUMCVSS 5.5EG 5.5
2024-11-11
Arbitrary file overwrite during recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.3.818, Acronis Backup plugin for cPanel & WHM (Linux) bef…
CVE-2024-27872MEDIUMCVSS 5.5EG 5.5
2024-07-29
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sonoma 14.6. An app may be able to access protected user data.
CVE-2021-1612MEDIUMCVSS 5.5EG 5.5
2021-09-23
A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated, local attacker to overwrite arbitrary files on the local system. This vulnerability is due to improper access controls on files within the local file sys…

Map vulnerabilities like CWE-61 to your infrastructure

EchelonGraph correlates every CVE — across CWE-61 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →