Improper Link Resolution Before File Access
CWE-59
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
We track 491 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.0. 25 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Latest Improper Link Resolution Before File Access vulnerabilities
- 7.0 High severity
Windows 11 Version 24H2: Improper Link Resolution Before File Access
Improper link resolution before file access ('link following') in Windows Resilient File System (ReFS) Deduplication Service allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Microsoft Windows Link Following Exploited
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Windows 10 Version 1607: Improper Link Resolution Before File Access
Improper link resolution before file access ('link following') in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Red Hat Hardened Images: Improper Link Resolution Before File Access
The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted
- 7.1 High severity
Elastic Security: Improper Link Resolution Before File Access
A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a sub
- 7.8 High severity
Backblaze Client: Improper Link Resolution Before File Access
A vulnerability in the Backblaze Client allows a local user to make the system not bootable by creating a link from Backblaze's folder to Windows OS system files during a backup. Successful exploitation requires an administrator-level system change that result
- 8.5 High severity
kubevela: Improper Link Resolution Before File Access
KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfiguratio
- 7.5 High severity
gitoxide: Improper Link Resolution Before File Access
gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-repository bytes into submodule metadata. Attackers can create a malicious repository with a symlinked .gitmodules pointing outside the repo
- 7.1 High severity
nltk: Improper Link Resolution Before File Access
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with w
- 7.3 High severity
openssl_encrypt: Improper Link Resolution Before File Access
openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. The scan enumerated the drive with rglob(), which in CPython does not descend into symlinked directories and treats the symlink as an o
- 7.8 High severity
codemeter-runtime: Improper Link Resolution Before File Access
In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, cmu.exe --create-io --file C: creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such
- 7.7 High severity
weblate: Improper Limitation of a Pathname to a Restricted Directory
Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-
- 7.0 High severity
NetExtender: Improper Link Resolution Before File Access
The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to manipulate file paths.
- 7.8 High severity
Red Hat Enterprise Linux 10: Improper Link Resolution Before File Access
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extracti
- 8.4 High severity
grav: Improper Link Resolution Before File Access
Grav CMS before 2.0.16 contains a symlink following vulnerability in Scheduler Job::createLockFile() that allows local attackers to overwrite arbitrary files by pre-creating symlinks at predictable lock file paths in the world-writable temp directory. Attacker
- 7.1 High severity
ONNX: Improper Limitation of a Pathname to a Restricted Directory
In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check. A local attacker with w
- 7.5 High severity
infinite-image-browsing: Improper Link Resolution Before File Access
to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links. A symlink placed inside a scanned directory therefore satisfies the containment comparison performed by is
- 9.9 Critical severity
incus: Improper Link Resolution Before File Access
Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with `can_create_images` and `can_create_instances`) can execute arbitrary code as root on the host. A
- 9.3 Critical severity
sshfs: Improper Link Resolution Before File Access
SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the
- 8.4 High severity
Chrome: Improper Link Resolution Before File Access
Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
- 7.1 High severity
go-archive: Improper Link Resolution Before File Access
The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory. The extractor decides where each archive entry lands using lexical stri
- 8.1 High severity
extract-zip: Improper Limitation of a Pathname to a Restricted Directory
extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed
- 7.8 High severity
Microsoft Malware Protection Engine: Improper Link Resolution Before File Access
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".
- 7.5 High severity
Q80: Improper Link Resolution Before File Access
PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit th
- 8.1 High severity
rsync: Improper Limitation of a Pathname to a Restricted Directory
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place
- 7.1 High severity
Dock Manager: Improper Link Resolution Before File Access
During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges.
- 7.8 High severity
rsync: Improper Link Resolution Before File Access
rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can e
- 8.1 High severity
rsync: Improper Link Resolution Before File Access
rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when the
- 7.4 High severity
rsync: Improper Link Resolution Before File Access
rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary mark
- 7.1 High severity
rsync: Improper Link Resolution Before File Access
rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows sym
- 7.1 High severity
rsync: Improper Link Resolution Before File Access
rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the modul
- 8.1 High severity
rsync: Improper Link Resolution Before File Access
rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component a
- 7.0 High severity
Commercial Vantage: Improper Link Resolution Before File Access
During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to execute code with elevated privileges.
- 7.1 High severity
Vantage: Improper Link Resolution Before File Access
An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges.
- 8.2 High severity
filebrowser: Improper Link Resolution Before File Access
filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with only Create permission to delete arbitrary files outside their scope. Attackers can swap an
- 9.9 Critical severity
LXD: Improper Link Resolution Before File Access
A link following vulnerability in LXD allows an attacker to achieve root command execution on the host system. During the import or unpacking of crafted image or backup archives, LXD fails to properly validate and confine the backup.yaml file when it exists as
- 9.9 Critical severity
LXD: Improper Link Resolution Before File Access
A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker
- 7.8 High severity
Windows 10 Version 21H2: Improper Link Resolution Before File Access
Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Windows 10 Version 1809: Improper Link Resolution Before File Access
Improper link resolution before file access ('link following') in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to elevate privileges locally.
- 7.1 High severity
Red Hat Enterprise Linux 10: Improper Link Resolution Before File Access
A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process I