CWE-59

{
  "affected": [],
  "aliases": [
    "CVE-2012-4676"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2012-08-26T19:55:00Z",
    "severity": "LOW"
  },
  "details": "The errorExitIfAttackViaString function in Tunnelblick 3.3beta20 and earlier allows local users to delete arbitrary files by constructing a (1) symlink or (2) hard link, a different vulnerability than CVE-2012-3485.",
  "id": "GHSA-rvmj-pg73-4rvj",
  "modified": "2022-05-17T05:25:07Z",
  "published": "2022-05-17T05:25:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4676"
    },
    {
      "type": "WEB",
      "url": "http://archives.neohapsis.com/archives/fulldisclosure/2012-08/0122.html"
    },
    {
      "type": "WEB",
      "url": "http://code.google.com/p/tunnelblick/issues/detail?id=212"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2012/08/14/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.8.4"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "bbot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.8.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-12567"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-59"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T15:04:00Z",
    "nvd_published_at": "2026-06-17T23:17:03Z",
    "severity": "LOW"
  },
  "details": "The `github_workflows` module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location.",
  "id": "GHSA-rvp7-w75q-9fv2",
  "modified": "2026-06-18T15:04:00Z",
  "published": "2026-06-18T15:04:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/blacklanternsecurity/bbot/security/advisories/GHSA-rvp7-w75q-9fv2"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12567"
    },
    {
      "type": "WEB",
      "url": "https://github.com/blacklanternsecurity/bbot/commit/16d9c42b6"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/blacklanternsecurity/bbot"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "BBOT: Symlink-Following Arbitrary Write via github_workflows Module"
}

{
  "affected": [],
  "aliases": [
    "CVE-1999-1386"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "1999-12-31T05:00:00Z",
    "severity": "LOW"
  },
  "details": "Perl 5.004_04 and earlier follows symbolic links when running with the -e option, which allows local users to overwrite arbitrary files via a symlink attack on the /tmp/perl-eaXXXXX file.",
  "id": "GHSA-rwp9-w3rx-vf92",
  "modified": "2024-01-26T18:30:27Z",
  "published": "2022-04-30T18:12:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-1999-1386"
    },
    {
      "type": "WEB",
      "url": "http://marc.info/?l=bugtraq\u0026m=88932165406213\u0026w=2"
    },
    {
      "type": "WEB",
      "url": "http://www.iss.net/security_center/static/7243.php"
    },
    {
      "type": "WEB",
      "url": "http://www.redhat.com/support/errata/rh50-errata-general.html#perl"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-26158"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-04-09T17:15:35Z",
    "severity": "HIGH"
  },
  "details": "Microsoft Install Service Elevation of Privilege Vulnerability",
  "id": "GHSA-rwv9-q2h8-5644",
  "modified": "2024-04-09T18:30:24Z",
  "published": "2024-04-09T18:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26158"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-26158"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.2.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32024"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-59"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-03T00:20:18Z",
    "nvd_published_at": "2026-03-19T22:16:36Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nOpenClaw avatar handling allowed a symlink traversal path that could expose local files outside an agent workspace through gateway avatar surfaces.\n\n### Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c= 2026.2.21`, plus prereleases `2026.2.21-1` and `2026.2.21-2`\n- Latest published version at triage time (2026-02-22): `2026.2.21-2` (affected)\n- Planned patched version (pre-set for release workflow): `2026.2.22`\n\n### Details\nIn vulnerable builds, local avatar resolution could follow symlinks and return file bytes from outside the configured workspace boundary.\n\nThe issue was hardened in two paths:\n1. Gateway avatar metadata resolution now enforces canonical containment, `O_NOFOLLOW`, and fd/file-identity checks.\n2. Control UI avatar serving now rejects symlink paths and enforces fd/file-identity and size checks before reads.\n\n### Fix Commit(s)\n- `3d0337504349954237d09e4d957df5cb844d5e77`\n- `6970c2c2db3ee069ef0fff0ade5cfbdd0134f9d2`\n\n### Release Process Note\n`patched_versions` is pre-set to `\u003e= 2026.2.22` so after npm release, the remaining action is to publish this advisory.\n\n### Impact\nConfidentiality impact only: local files readable by the OpenClaw process could be disclosed via avatar response surfaces.\n\nOpenClaw thanks @tdjackey for reporting.",
  "id": "GHSA-rx3g-mvc3-qfjf",
  "modified": "2026-03-20T21:36:57Z",
  "published": "2026-03-03T00:20:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-rx3g-mvc3-qfjf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32024"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/3d0337504349954237d09e4d957df5cb844d5e77"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/6970c2c2db3ee069ef0fff0ade5cfbdd0134f9d2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/openclaw-symlink-traversal-in-avatar-handling"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw\u0027s avatar symlink traversal can expose out-of-workspace local files"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-21188"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-11T18:15:30Z",
    "severity": "MODERATE"
  },
  "details": "Azure Network Watcher VM Extension Elevation of Privilege Vulnerability",
  "id": "GHSA-rxc7-mfvv-r2xp",
  "modified": "2025-02-11T18:31:36Z",
  "published": "2025-02-11T18:31:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21188"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21188"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-32556"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-26T22:15:10Z",
    "severity": "MODERATE"
  },
  "details": "A link following vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to disclose sensitive information.\n\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
  "id": "GHSA-rxxg-crv8-fgvm",
  "modified": "2024-04-04T05:11:30Z",
  "published": "2023-06-27T00:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32556"
    },
    {
      "type": "WEB",
      "url": "https://success.trendmicro.com/dcx/s/solution/000293108?language=en_US"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-23-651"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-2898"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-08-31T21:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow a denial-of-service condition.",
  "id": "GHSA-v28m-hg58-94hp",
  "modified": "2022-09-03T00:00:16Z",
  "published": "2022-09-01T00:00:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2898"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2012-0786"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2013-11-23T18:55:00Z",
    "severity": "LOW"
  },
  "details": "The transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augnew file.",
  "id": "GHSA-v2f6-mg42-536m",
  "modified": "2022-05-17T04:54:10Z",
  "published": "2022-05-17T04:54:10Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0786"
    },
    {
      "type": "WEB",
      "url": "https://github.com/hercules-team/augeas/commit/16387744"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=772257"
    },
    {
      "type": "WEB",
      "url": "http://augeas.net/news.html"
    },
    {
      "type": "WEB",
      "url": "http://rhn.redhat.com/errata/RHSA-2013-1537.html"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/55811"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-52837"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-59",
      "CWE-64"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-10T19:15:25Z",
    "severity": "HIGH"
  },
  "details": "Trend Micro Password Manager (Consumer) version 5.8.0.1327 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow an attacker the opportunity to abuse symbolic links and other methods to delete any file/folder and achieve privilege escalation.",
  "id": "GHSA-v338-m87c-mjx4",
  "modified": "2025-07-10T21:31:52Z",
  "published": "2025-07-10T21:31:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52837"
    },
    {
      "type": "WEB",
      "url": "https://helpcenter.trendmicro.com/en-us/article/TMKA-12946"
    },
    {
      "type": "WEB",
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-586"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}