Improper Link Resolution Before File Access
CWE-59
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
We track 491 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.0. 25 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Latest Improper Link Resolution Before File Access vulnerabilities
- 7.8 High severity
Trend Micro Apex One: Improper Link Resolution Before File Access
A link following vulnerability in the scanning function of Trend Micro Apex One and Worry-Free Business Security agents could allow a local attacker to escalate privileges on affected installations. The resolution for this issue has been deployed automatically
- 7.8 High severity
Tumbleweed: Improper Link Resolution Before File Access
A UNIX Symbolic Link (Symlink) Following vulnerability in keylime of openSUSE Tumbleweed allows local attackers to escalate from the keylime user to root. This issue affects: openSUSE Tumbleweed keylime versions prior to 6.4.2-1.1.
- 7.1 High severity
Anydesk: Improper Link Resolution Before File Access
AnyDesk 7.0.9 allows a local user to gain SYSTEM privileges via a symbolic link because the user can write to their own %APPDATA% folder (used for ad.trace and chat) but the product runs as SYSTEM when writing chat-room data there.
- 7.8 High severity
WARP: Improper Link Resolution Before File Access
Cloudflare WARP client for Windows (up to v. 2022.5.309.0) allowed creation of mount points from its ProgramData folder. During installation of the WARP client, it was possible to escalate privileges and overwrite SYSTEM protected files.
- 7.8 High severity
Antivirus: Improper Link Resolution Before File Access
Comodo Antivirus 12.2.2.8012 has a quarantine flaw that allows privilege escalation. To escalate privilege, a low-privileged attacker can use an NTFS directory junction to restore a malicious DLL from quarantine into the System32 folder.
- 7.5 High severity
github.com/argoproj/argo-events/sensors/artifac…: Improper Limitation of a Pathname to a Restricted Directory
The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the (g *GitArtifactReader).Read() API in git.go. This could allow arbitrary file reads if the GitArtifactReader is provided a pathname containin
- 7.8 High severity
Yandex Browser (Desktop): Improper Link Resolution Before File Access
Local privilege vulnerability in Yandex Browser for Windows prior to 22.3.3.684 allows a local, low privileged, attacker to execute arbitary code with the SYSTEM privileges through manipulating symlinks to installation file during Yandex Browser update process
- 7.8 High severity
Drive Composer entry: Improper Link Resolution Before File Access
Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileg
- 7.8 High severity
Drive Composer entry: Improper Link Resolution Before File Access
Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileg
- 7.8 High severity
Drive Composer entry: Improper Link Resolution Before File Access
Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileg
- 7.8 High severity
Drive Composer entry: Improper Link Resolution Before File Access
Vulnerabilities in the Drive Composer allow a low privileged attacker to create and write to a file anywhere on the file system as SYSTEM with arbitrary content as long as the file does not already exist. The Drive Composer installer file allows a low-privileg
- 7.1 High severity
Trend Micro Maximum Security: Improper Link Resolution Before File Access
Trend Micro Maximum Security 2022 is vulnerable to a link following vulnerability that could allow a low privileged local user to manipulate the product's secure erase feature to delete arbitrary files.
- 7.8 High severity
macOS: Improper Link Resolution Before File Access
A validation issue existed in the handling of symlinks and was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.4. An app may be able to gain elevated privileges.
- 8.6 High severity
Go-getter: Improper Limitation of a Pathname to a Restricted Directory
go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0.
- 7.0 High severity
Total Security: Improper Link Resolution Before File Access
Time of Check - Time of Use (TOCTOU) vulnerability in Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, potentially leading to deletion of system files. This is achieved through exploiting the time between de
- 7.8 High severity
Trend Micro Password Manager: Improper Link Resolution Before File Access
Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow a low privileged local attacker to delete the contents of an arbitrary folder as SYSTEM which can then be
- 7.8 High severity
Check Point Endpoint Security Client for Windows: Improper Link Resolution Before File Access
Check Point Endpoint Security Client for Windows versions earlier than E86.40 copy files for forensics reports from a directory with low privileges. An attacker can replace those files with malicious or linked content, such as exploiting CVE-2020-0896 on unpat
- 7.5 High severity
RARLAB UnRAR Directory Traversal Exploited
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.
- 7.2 High severity
Cisco IOS: Improper Link Resolution Before File Access
Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system
- 7.8 High severity
McAfee Agent for Windows: Improper Link Resolution Before File Access
A local privilege escalation vulnerability in MA for Windows prior to 5.7.6 allows a local low privileged user to gain system privileges through running the repair functionality. Temporary file actions were performed on the local user's %TEMP% directory with S
- 7.8 High severity
VMware Horizon Agent for Linux: Improper Link Resolution Before File Access
VMware Horizon Agent for Linux (prior to 22.x) contains a local privilege escalation as a user is able to change the default shared folder location due to a vulnerable symbolic link. Successful exploitation can result in linking to a root owned file.
- 7.3 High severity
Trend Micro Antivirus for Mac: Improper Link Resolution Before File Access
A link following vulnerability in Trend Micro Antivirus for Mac 11.5 could allow an attacker to create a specially-crafted file as a symlink that can lead to privilege escalation. Please note that an attacker must at least have low-level privileges on the syst
- 9.8 Critical severity
Apache Hadoop: Improper Link Resolution Before File Access
In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A sub
- 8.8 High severity
Chrome: Improper Link Resolution Before File Access
Insufficient policy enforcement in Installer in Google Chrome on Windows prior to 99.0.4844.51 allowed a remote attacker to perform local privilege escalation via a crafted offline installer file.
- 9.8 Critical severity
My Cloud: Improper Link Resolution Before File Access
The combination of primitives offered by SMB and AFP in their default configuration allows the arbitrary writing of files. By exploiting these combination of primitives, an attacker can execute arbitrary code.
- 7.1 High severity
Docker Desktop: Improper Link Resolution Before File Access
Docker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any administrator writable files by creating a symlink in place of where the installer writes its log file. Starting from version 4.6.0, the Docker Desktop installer,
- 7.5 High severity
iOS and iPadOS: Improper Link Resolution Before File Access
An issue existed within the path validation logic for symlinks. This issue was addressed with improved path sanitization. This issue is fixed in iOS 15.3 and iPadOS 15.3, watchOS 8.4, tvOS 15.3, macOS Monterey 12.2, macOS Big Sur 11.6.3. An application may be
- 7.7 High severity
Armoury Crate & Aura Creator Installer (ROG…: Improper Link Resolution Before File Access
ROG Live Service’s function for deleting temp files created by installation has an improper link resolution before file access vulnerability. Since this function does not validate the path before deletion, an unauthenticated local attacker can create an unexpe
- 7.8 High severity
Trend Micro Apex One: Improper Link Resolution Before File Access
A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business Security 10.0 SP1 and Trend Micro Worry-Free Business Security Services agents could allow a local at
- 7.8 High severity
Trend Micro Apex One: Improper Link Resolution Before File Access
A security link following local privilege escalation vulnerability in Trend Micro Apex One, Trend Micro Apex One as a Service, Trend Micro Worry-Free Business Security 10.0 SP1 and Trend Micro Worry-Free Business Security Services agents could allow a local at
- 7.8 High severity
Trend Micro Antivirus for Mac: Improper Link Resolution Before File Access
A link following privilege escalation vulnerability in Trend Micro Antivirus for Max 11.0.2150 and below could allow a local attacker to modify a file during the update process and escalate their privileges. Please note: an attacker must first obtain the abili
- 7.8 High severity
GlobalProtect App: Improper Link Resolution Before File Access
An improper link resolution before file access ('link following') vulnerability exists in the Palo Alto Networks GlobalProtect app on Windows that enables a local attacker to disrupt system processes and potentially execute arbitrary code with SYSTEM privilege
- 4.6 Medium severity
Microsoft Windows Print Spooler Privilege Escalation Exploited
Windows Print Spooler Elevation of Privilege Vulnerability
- 7.8 High severity
openSUSE Backports SLE-15-SP3: Improper Link Resolution Before File Access
A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attackers to escalate to root. This issue affects: openSUSE Backports SLE-15-SP3 watchman versions prior to 4
- 7.1 High severity
Cortex XDR Agent: Improper Link Resolution Before File Access
An improper link resolution before file access vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables a local user to delete arbitrary system files and impact the system integrity or cause a denial of service conditio
- 6.9 Medium severity
Microsoft Windows User Profile Service Privilege Escalation Exploited
Windows User Profile Service Elevation of Privilege Vulnerability
- 7.8 High severity
Microsoft Windows Installer Privilege Escalation Exploited
Windows Installer Elevation of Privilege Vulnerability
- 7.5 High severity
PEAR Archive_Tar Improper Link Resolution Exploited
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
- 7.8 High severity
Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Exploited
An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic links, aka 'Windows Background Intelligent Transfer Service Elevation of Privilege Vulnerability'.
- 7.8 High severity
Microsoft Windows Installer Privilege Escalation Exploited
An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-0686.