Improper Link Resolution Before File Access
CWE-59
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
We track 491 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.0. 25 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
Latest Improper Link Resolution Before File Access vulnerabilities
- 7.8 High severity
AntiDupl: Improper Link Resolution Before File Access
A vulnerability was detected in ermig1979 AntiDupl up to 2.3.12. Impacted is an unknown function of the file AntiDupl.NET.WinForms.exe of the component Delete Duplicate Image Handler. The manipulation results in link following. The attack is only possible with
- 8.6 High severity
git-lfs: Improper Link Resolution Before File Access
Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git wo
- 7.8 High severity
Windows 11 Version 24H2: Improper Link Resolution Before File Access
Improper link resolution before file access ('link following') in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
YtGrabber-TUI: Improper Link Resolution Before File Access
yt-grabber-tui is a terminal user interface application for downloading videos. In versions before 1.0-rc, the application allows users to configure the path to the yt-dlp executable via the path_to_yt_dlp configuration setting. An attacker with write access t
- 8.5 High severity
Armoury Crate: Improper Link Resolution Before File Access
A link following vulnerability exists in the UnifyScanner component of Armoury Crate. This vulnerability may be triggered by creating a specially crafted junction, potentially leading to local privilege escalation. For more information, please refer to section
- 7.0 High severity
DesktopCommanderMCP: Improper Link Resolution Before File Access
A security vulnerability has been detected in wonderwhy-er DesktopCommanderMCP up to 0.2.13. This vulnerability affects the function isPathAllowed of the file src/tools/filesystem.ts. The manipulation leads to symlink following. The attack can only be performe
- 7.8 High severity
Client VPN: Improper Link Resolution Before File Access
Improper Link Resolution Before File Access in the AWS VPN Client for macOS versions 1.3.2- 5.2.0 allows a local user to execute code with elevated privileges. Insufficient validation checks on the log destination directory during log rotation could allow a no
- 7.8 High severity
Print Virtual Appliance Host: Improper Link Resolution Before File Access
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (Windows client deployments) contain an insecure temporary-file handling vulnerability in the PrinterInstallerClient components.
- 8.4 High severity
Print Virtual Appliance Host: Improper Link Resolution Before File Access
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (macOS/Linux client deployments) contain an arbitrary file write vulnerability via the response file handling. When tasks produce output t
- 7.8 High severity
Microsoft AutoUpdate for Mac: Improper Link Resolution Before File Access
Improper link resolution before file access ('link following') in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Alienware Command Center 5.x (AWCC): Improper Link Resolution Before File Access
Dell Alienware Command Center 5.x (AWCC), versions prior to 5.10.2.0, contains an Improper Link Resolution Before File Access ('Link Following')" vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading t
- 7.3 High severity
Backupper Workstation: Improper Link Resolution Before File Access
AOMEI Backupper Workstation Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of AOMEI Backupper Workstation. An attacker must first obtain the ability to execute
- 7.3 High severity
SESU: Improper Link Resolution Before File Access
CWE-59: Improper Link Resolution Before File Access ('Link Following') vulnerability exists that could cause arbitrary data to be written to protected locations, potentially leading to escalation of privilege, arbitrary file corruption, exposure of application
- 7.5 High severity
Shared library: Improper Link Resolution Before File Access
HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated directory boundaries. This vulnerability, identified as CVE-2025-8959, is fixed in go-getter 1.7.9.
- 8.4 High severity
HP Hotkey Support Software: Improper Link Resolution Before File Access
A potential security vulnerability has been identified in the HPAudioAnalytics service included in the HP Hotkey Support software, which might allow escalation of privilege. HP is releasing software updates to mitigate the potential vulnerability.
- 7.8 High severity
Encryption: Improper Link Resolution Before File Access
Dell Encryption and Dell Security Management Server, versions prior to 11.11.0, contain an Improper Link Resolution Before File Access ('Link Following') Vulnerability. A local malicious user could potentially exploit this vulnerability, leading to privilege e
- 9.8 Critical severity
iPadOS: Improper Link Resolution Before File Access
This issue was addressed with improved validation of symlinks. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7. An app may be able to access protected user data.
- 8.5 High severity
Container Toolkit: Improper Link Resolution Before File Access
NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook, where an attacker could cause a link following by using a specially crafted container image. A successful exploit of this vulnerability might lead to data tampering
- 8.6 High severity
Cato Client: Improper Link Resolution Before File Access
An issue in Cato Networks' CatoClient for Linux, before version 5.5, allows a local attacker to escalate privileges to root by exploiting improper symbolic link handling.
- 7.8 High severity
Trend Micro Password Manager: Improper Link Resolution Before File Access
Trend Micro Password Manager (Consumer) version 5.8.0.1327 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow an attacker the opportunity to abuse symbolic links and other methods to delete any file/folder and achie
- 8.0 High severity
Git Link Following Exploited
Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). Wh
- 7.8 High severity
Windows 10 Version 1507: Improper Link Resolution Before File Access
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
- 8.8 High severity
AXC F 1152: Improper Link Resolution Before File Access
A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute access to any file on the device.
- 8.8 High severity
AXC F 1152: Improper Link Resolution Before File Access
A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file on the device.
- 8.8 High severity
AXC F 1152: Improper Link Resolution Before File Access
A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the device after the watchdog has been initialized.
- 7.3 High severity
servers: Improper Link Resolution Before File Access
Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versions of Filesystem prior to 0.6.4 or 2025.7.01 could allow access to unintended files via symlinks within allowed directories. Users are advis
- 7.1 High severity
System Information Reporter: Improper Link Resolution Before File Access
A path or symbolic link manipulation vulnerability in SIR 1.0.3 and prior versions allows an authenticated non-admin local user to overwrite system files with SIR backup files, which can potentially cause a system crash. This was achieved by adding a malicious
- 7.8 High severity
Trend Micro Deep Security: Improper Link Resolution Before File Access
A link following vulnerability in the anti-malware solution portion of Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-pr
- 7.8 High severity
Trend Micro Deep Security: Improper Link Resolution Before File Access
A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in
- 7.8 High severity
Trend Micro Apex One: Improper Link Resolution Before File Access
A link following vulnerability in the Trend Micro Apex One Damage Cleanup Engine could allow a local attacker to escalation privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the targe
- 7.8 High severity
Trend Micro Apex One: Improper Link Resolution Before File Access
A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalation privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system i
- 7.3 High severity
Windows 10 Version 1507: Improper Link Resolution Before File Access
Improper link resolution before file access ('link following') in Windows Recovery Driver allows an authorized attacker to elevate privileges locally.
- 7.3 High severity
SyncBackFree: Improper Link Resolution Before File Access
2BrightSparks SyncBackFree Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of 2BrightSparks SyncBackFree. An attacker must first obtain the ability to execute l
- 7.8 High severity
Encryption Admin Utilities: Improper Link Resolution Before File Access
Dell Encryption Admin Utilities versions prior to 11.10.2 contain an Improper Link Resolution vulnerability. A local malicious user could potentially exploit this vulnerability, leading to privilege escalation.
- 7.8 High severity
Parallels Desktop for Mac: Improper Link Resolution Before File Access
A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is taken, a root service writes to a file owned by a normal user. By using a hard link, an
- 7.8 High severity
Parallels Desktop for Mac: Improper Link Resolution Before File Access
A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtual machine is deleted, a root service verifies and modifies the ownership of the snapshot files. By u
- 7.8 High severity
Parallels Desktop for Mac: Improper Link Resolution Before File Access
A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When an archived virtual machine is restored, the prl_vmarchiver tool decompresses the file and writes the
- 7.8 High severity
Bluetooth HCI Adaptor: Improper Link Resolution Before File Access
Bluetooth HCI Adaptor from Realtek has a Link Following vulnerability. Local attackers with regular privileges can create a symbolic link with the same name as a specific file, causing the product to delete arbitrary files pointed to by the link. Subsequently,
- 8.8 High severity
Microsoft Edge (Chromium-based) Updater: Improper Link Resolution Before File Access
Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
- 7.3 High severity
Qt: Improper Link Resolution Before File Access
Improper Link Resolution Before File Access ('Link Following') vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows Symlink Attacks and the use of Malicious Files. Issue originates from CVE-2024-38081. The vulnerabili