CWE-61 UNIX Symbolic Link (Symlink) Following
compoundThe product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (229)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-54420US | —OT critical | KEV | ||
LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting… | ||||
| CVE-2023-37460US | critical9.8 | Exploit | ||
Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified `Archiver`/`UnArchiver` API. Prior to version 4.8.0, using… | ||||
| CVE-2026-34078US | critical10.0 | — | ||
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled sy… | ||||
| CVE-2025-31133US | high7.8 | Exploit | ||
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7 and below, 1.3.0-rc.1 through 1.3.1, 1.4.0-rc.1 and 1.4.0-rc.2 files, r… | ||||
| CVE-2023-38571US | high7.5 | Exploit | ||
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Big Sur 11.7.9, macOS Monterey 12.6.8, macOS Ventura 13.5. An app may be able to bypass… | ||||
| CVE-2026-39861US | critical10.0 | — | ||
Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed processes from creating symlinks pointing to locations outside the w… | ||||
| CVE-2025-52881US | high7.5 | Exploit | ||
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting wri… | ||||
| CVE-2025-62596US | critical10.0 | — | ||
Youki is a container runtime written in Rust. In versions 0.5.6 and below, youki’s apparmor handling performs insufficiently strict write-target validation, and when combined with… | ||||
| CVE-2025-62161US | critical10.0 | — | ||
Youki is a container runtime written in Rust. In versions 0.5.6 and below, the initial validation of the source /dev/null is insufficient, allowing container escape when youki util… | ||||
| CVE-2022-26612US | critical9.8 | — | ||
In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink unde… | ||||
| CVE-2026-91099US | critical9.8 | — | ||
HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote cod… | ||||
| CVE-2017-14798US | high7.0 | Exploit | ||
A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root. | ||||
| CVE-2024-45418US | high8.8 | — | ||
Symlink following in the installer for some Zoom apps for macOS before version 6.1.5 may allow an authenticated user to conduct an escalation of privilege via network access. | ||||
| CVE-2024-52535US | high8.8 | — | ||
Dell SupportAssist for Home PCs versions 4.6.1 and prior and Dell SupportAssist for Business PCs versions 4.5.0 and prior, contain a symbolic link (symlink) attack vulnerability in… | ||||
| CVE-2024-44132US | high8.8 | — | ||
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15. An app may be able to break out of its sandbox. | ||||
| CVE-2023-25152US | high8.8 | — | ||
Wings is Pterodactyl's server control plane. Affected versions are subject to a vulnerability which can be used to create new files and directory structures on the host system that… | ||||
| CVE-2026-39860US | high8.4 | — | ||
Nix is a package manager for Linux and other Unix systems. A bug in the fix for CVE-2024-27297 allowed for arbitrary overwrites of files writable by the Nix process orchestrating t… | ||||
| CVE-2025-67487US | high8.6 | — | ||
Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Versions 2.40.0 and below contain symbolic links (symlinks) which can be used to a… | ||||
| CVE-2026-41326US | high8.2 | — | ||
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. From v3.4.0 to v3.28.0, an overs… | ||||
| CVE-2026-115392US | high7.9 | — | ||
Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem sandbox escape in wasmtime-wasi because its cap-std dependency mi… | ||||
03
attack patterns (1)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan