CWE-59
AllowedImproper Link Resolution Before File Access ('Link Following')
Abstraction: Base · Status: Draft
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
2239 vulnerabilities reference this CWE, most recent first.
GHSA-GMW6-94GG-2RC2
Vulnerability from github – Published: 2021-08-31 16:03 – Updated: 2022-06-17 20:51Impact
Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution
@npmcli/arborist, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder.
This is accomplished by extracting package contents into a project's node_modules folder.
If the node_modules folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could allow Arborist to write package dependencies to any arbitrary location on the file system.
Note that symbolic links contained within package artifact contents are filtered out, so another means of creating a node_modules symbolic link would have to be employed.
- A
preinstallscript could replacenode_moduleswith a symlink. (This is prevented by using--ignore-scripts.) - An attacker could supply the target with a git repository, instructing them to run
npm install --ignore-scriptsin the root. This may be successful, becausenpm install --ignore-scriptsis typically not capable of making changes outside of the project directory, so it may be deemed safe.
Patches
2.8.2 (included in npm v7.20.7 and above)
Workarounds
Do not run npm install on untrusted codebases, without first ensuring that the node_modules directory in the project is not a symbolic link.
Fix
Prior to extracting any package contents, the node_modules folder into which it is extracted is verified to be a real directory. If it is not, then it is removed.
Caveat: if you are currently relying on creating a symbolic link to the node_modules folder in order to share dependencies between projects, then that will no longer be possible. Please use the npm link command, explicit file:... dependencies, and/or workspaces to share dependencies in a development environment.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@npmcli/arborist"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-39135"
],
"database_specific": {
"cwe_ids": [
"CWE-59",
"CWE-61"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-31T16:03:00Z",
"nvd_published_at": "2021-08-31T17:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n\nArbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution\n\n`@npmcli/arborist`, the library that calculates dependency trees and manages the node_modules folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package contents will always be performed into the expected folder.\n\nThis is accomplished by extracting package contents into a project\u0027s `node_modules` folder.\n\nIf the `node_modules` folder of the root project or any of its dependencies is somehow replaced with a symbolic link, it could allow Arborist to write package dependencies to any arbitrary location on the file system.\n\nNote that symbolic links contained within package artifact contents are filtered out, so another means of creating a `node_modules` symbolic link would have to be employed.\n\n1. A `preinstall` script could replace `node_modules` with a symlink. (This is prevented by using `--ignore-scripts`.)\n2. An attacker could supply the target with a git repository, instructing them to run `npm install --ignore-scripts` in the root. This may be successful, because `npm install --ignore-scripts` is typically not capable of making changes outside of the project directory, so it may be deemed safe.\n\n### Patches\n\n2.8.2 (included in npm v7.20.7 and above)\n\n### Workarounds\n\nDo not run `npm install` on untrusted codebases, without first ensuring that the `node_modules` directory in the project is not a symbolic link.\n\n### Fix\n\nPrior to extracting any package contents, the `node_modules` folder into which it is extracted is verified to be a real directory. If it is not, then it is removed.\n\nCaveat: if you are currently relying on creating a symbolic link to the `node_modules` folder in order to share dependencies between projects, then that will no longer be possible. Please use the `npm link` command, explicit `file:...` dependencies, and/or `workspaces` to share dependencies in a development environment.",
"id": "GHSA-gmw6-94gg-2rc2",
"modified": "2022-06-17T20:51:19Z",
"published": "2021-08-31T16:03:34Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39135"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"
},
{
"type": "PACKAGE",
"url": "https://github.com/npm/arborist"
},
{
"type": "WEB",
"url": "https://www.npmjs.com/package/@npmcli/arborist"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "UNIX Symbolic Link (Symlink) Following in @npmcli/arborist"
}
GHSA-GPCM-H3WC-3765
Vulnerability from github – Published: 2022-11-23 18:30 – Updated: 2022-11-28 21:30An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can gain privileges via a symlink attack on /tmp files if vmware-user-suid-wrapper is setuid root and the ChmodChownDirectory function is enabled.
{
"affected": [],
"aliases": [
"CVE-2009-1142"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-23T18:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in open-vm-tools 2009.03.18-154848. Local users can gain privileges via a symlink attack on /tmp files if vmware-user-suid-wrapper is setuid root and the ChmodChownDirectory function is enabled.",
"id": "GHSA-gpcm-h3wc-3765",
"modified": "2022-11-28T21:30:23Z",
"published": "2022-11-23T18:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1142"
},
{
"type": "WEB",
"url": "https://bugs.gentoo.org/264577"
},
{
"type": "WEB",
"url": "https://github.com/vmware/open-vm-tools/releases/tag/2009.03.18-154848"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GPF6-HGGM-45PW
Vulnerability from github – Published: 2026-08-18 21:34 – Updated: 2026-08-19 12:32Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)
{
"affected": [],
"aliases": [
"CVE-2026-76037"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-18T21:18:27Z",
"severity": "HIGH"
},
"details": "Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High)",
"id": "GHSA-gpf6-hggm-45pw",
"modified": "2026-08-19T12:32:22Z",
"published": "2026-08-18T21:34:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76037"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/517612295"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-GPH2-PH9G-MQFQ
Vulnerability from github – Published: 2022-05-01 07:32 – Updated: 2022-05-01 07:32openexec in OpenBase SQL before 10.0.1 allows local users to create arbitrary files via a symlink attack on the /tmp/output file, a different vulnerability than CVE-2006-5328.
{
"affected": [],
"aliases": [
"CVE-2006-5851"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2006-11-10T02:07:00Z",
"severity": "LOW"
},
"details": "openexec in OpenBase SQL before 10.0.1 allows local users to create arbitrary files via a symlink attack on the /tmp/output file, a different vulnerability than CVE-2006-5328.",
"id": "GHSA-gph2-ph9g-mqfq",
"modified": "2022-05-01T07:32:23Z",
"published": "2022-05-01T07:32:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2006-5851"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/2737"
},
{
"type": "WEB",
"url": "http://marc.info/?l=full-disclosure\u0026m=116296717330758\u0026w=2"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/22742"
},
{
"type": "WEB",
"url": "http://www.digitalmunition.com/DMA%5B2006-1107a%5D.txt"
},
{
"type": "WEB",
"url": "http://www.vupen.com/english/advisories/2006/4404"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GPV2-XXVX-F68G
Vulnerability from github – Published: 2022-05-13 01:06 – Updated: 2025-04-12 12:34libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on a temporary file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-2179.
{
"affected": [],
"aliases": [
"CVE-2014-3977"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-06-08T23:55:00Z",
"severity": "MODERATE"
},
"details": "libodm.a in IBM AIX 6.1 and 7.1, and VIOS 2.2.x, allows local users to overwrite arbitrary files via a symlink attack on a temporary file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-2179.",
"id": "GHSA-gpv2-xxvx-f68g",
"modified": "2025-04-12T12:34:34Z",
"published": "2022-05-13T01:06:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3977"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/93595"
},
{
"type": "WEB",
"url": "https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-3977"
},
{
"type": "WEB",
"url": "http://aix.software.ibm.com/aix/efixes/security/libodm_advisory.asc"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/127067/IBM-AIX-6.1.8-Privilege-Escalation.html"
},
{
"type": "WEB",
"url": "http://www.exploit-db.com/exploits/33725"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=isg1IV60299"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=isg1IV60303"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=isg1IV60311"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=isg1IV60312"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=isg1IV60313"
},
{
"type": "WEB",
"url": "http://www.ibm.com/support/docview.wss?uid=isg1IV60314"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1030401"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GQ3G-4FMC-4F5J
Vulnerability from github – Published: 2022-05-02 03:28 – Updated: 2022-05-02 03:28Coccinelle 0.1.7 allows local users to overwrite arbitrary files via a symlink attack on an unspecified "result file."
{
"affected": [],
"aliases": [
"CVE-2009-1753"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-05-22T11:53:00Z",
"severity": "LOW"
},
"details": "Coccinelle 0.1.7 allows local users to overwrite arbitrary files via a symlink attack on an unspecified \"result file.\"",
"id": "GHSA-gq3g-4fmc-4f5j",
"modified": "2022-05-02T03:28:14Z",
"published": "2022-05-02T03:28:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-1753"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00731.html"
},
{
"type": "WEB",
"url": "http://packages.debian.org/changelogs/pool/main/c/coccinelle/coccinelle_0.1.7.deb-3/changelog"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35012"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/35459"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2009/05/06/2"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/34848"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GQ9C-43PH-F77C
Vulnerability from github – Published: 2022-05-02 03:52 – Updated: 2022-05-02 03:52Merkaartor 0.14 allows local users to append data to arbitrary files via a symlink attack on the /tmp/merkaartor.log temporary file.
{
"affected": [],
"aliases": [
"CVE-2009-4193"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-12-03T19:30:00Z",
"severity": "LOW"
},
"details": "Merkaartor 0.14 allows local users to append data to arbitrary files via a symlink attack on the /tmp/merkaartor.log temporary file.",
"id": "GHSA-gq9c-43ph-f77c",
"modified": "2022-05-02T03:52:40Z",
"published": "2022-05-02T03:52:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-4193"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53486"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00869.html"
},
{
"type": "WEB",
"url": "https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00870.html"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=548546"
},
{
"type": "WEB",
"url": "http://osvdb.org/58389"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/36897"
},
{
"type": "WEB",
"url": "http://trac.openstreetmap.org/ticket/2320"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/36529"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GQ9W-WR34-CG54
Vulnerability from github – Published: 2022-05-24 17:40 – Updated: 2022-05-24 17:40IBM Security Identity Governance and Intelligence 5.2.6 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 192423.
{
"affected": [],
"aliases": [
"CVE-2020-4966"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-21T14:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Security Identity Governance and Intelligence 5.2.6 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 192423.",
"id": "GHSA-gq9w-wr34-cg54",
"modified": "2022-05-24T17:40:02Z",
"published": "2022-05-24T17:40:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-4966"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/192423"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6403233"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-GQQQ-9PQW-6V5R
Vulnerability from github – Published: 2022-04-21 01:57 – Updated: 2024-02-28 01:09The init script in autokey before 0.61.3-2 allows local attackers to write to arbitrary files via a symlink attack.
{
"affected": [],
"aliases": [
"CVE-2010-0398"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-10-30T22:15:00Z",
"severity": "MODERATE"
},
"details": "The init script in autokey before 0.61.3-2 allows local attackers to write to arbitrary files via a symlink attack.",
"id": "GHSA-gqqq-9pqw-6v5r",
"modified": "2024-02-28T01:09:58Z",
"published": "2022-04-21T01:57:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2010-0398"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ubuntu/+source/autokey/+bug/538471"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2010-0398"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-GQQR-58QX-V9QR
Vulnerability from github – Published: 2022-05-17 02:18 – Updated: 2022-05-17 02:18tau 2.16.4 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/makefile.tau..##### or (2) /tmp/makefile.tau.##### temporary file, related to the (a) tau_cxx, (b) tau_f90, and (c) tau_cc scripts.
{
"affected": [],
"aliases": [
"CVE-2008-5157"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-11-18T16:00:00Z",
"severity": "MODERATE"
},
"details": "tau 2.16.4 allows local users to overwrite arbitrary files via a symlink attack on a (1) /tmp/makefile.tau.*.##### or (2) /tmp/makefile.tau*.##### temporary file, related to the (a) tau_cxx, (b) tau_f90, and (c) tau_cc scripts.",
"id": "GHSA-gqqr-58qx-v9qr",
"modified": "2022-05-17T02:18:02Z",
"published": "2022-05-17T02:18:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-5157"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46704"
},
{
"type": "WEB",
"url": "http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506348"
},
{
"type": "WEB",
"url": "http://lists.debian.org/debian-devel/2008/08/msg00347.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/32821"
},
{
"type": "WEB",
"url": "http://uvw.ru/report.sid.txt"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/32404"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation MIT-48.1
Strategy: Separation of Privilege
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack
An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.