CWE-59
CVEs classified under CWE-59, newest first.
386 CVEsRSS
CVE-2026-114462Medium· 6.0Arbitrary File Read via Symlink in Velneo vServer HTTP Server
Improper link resolution before file access ('link following') vulnerability in Velneo vServer. This issue affects vServer: from 32.3 before 36.6 and from 37.1 before 37.2.
CVE-2026-114096High· 7.8PoCDulwich 0.24.0 before 1.2.8 Symlink Write-Through via porcelain.checkout paths
Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write arbitrary files by abusing raw os.open without O_NOFOLLOW. Attackers can craft a repository whe…
CVE-2026-113716Medium· 4.5virtualenv: Builtin creation follows linked environment directories
virtualenv: Builtin creation follows linked environment directories
CVE-2026-113724Medium· 4.5PoCvirtualenv: Deletion recovery can change a symlink target's mode
virtualenv: Deletion recovery can change a symlink target's mode
CVE-2026-113678Critical· 9.9PoCFroxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron
Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can…
CVE-2026-111045High· 7.5CLI Bridge: High-severity sandbox escape via dangling symlink
CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback reso…
CVE-2026-112210Medium· 6.0Rhc: rhc: local privilege escalation via symlink following in rhc-canonical-facts.service
A flaw was found in the rhc-canonical-facts.service systemd unit shipped with rhc. The service runs as root and operates on a file inside a directory owned by an unprivileged system user without verifying that the file is not a symbolic …
CVE-2026-111802Medium· 6.6Nautilus: nautilus: arbitrary file deletion via trash symlink
A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this…
CVE-2026-62268Mediumborg extract might modify out-of-tree files when extracting maliciously crafted archives
borg extract might modify out-of-tree files when extracting maliciously crafted archives
CVE-2026-64672MediumTerragrunt catalog predictable temp symlink clobber
Terragrunt catalog predictable temp symlink clobber
CVE-2026-55480Medium· 5.7PoCOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable dire…
CVE-2026-53882High· 8.7An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station
An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the secu…
CVE-2026-110860Medium· 6.1PoCGitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components
GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit …
CVE-2026-104109Medium· 6.8PoCFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise validates archive entry names but extracts them directly into the authorized live destination before valida…
CVE-2026-55498Medium· 4.8PoCFileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.15.0, FileRise public shared-folder links with subfolder browsing enabled can follow a symbolic link inside the shared fol…
CVE-2026-110767High· 7.5PoCGitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs
Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs. Attackers can commit a symlink to a…
CVE-2026-104103High· 8.1Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models
Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.extract_archive() validated tar member names before calling TarFile.extractall() but did not validat…
CVE-2026-103975Medium· 6.5PoCAppium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol
Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 7.2.6, @appium/support ZIP extraction accepts an archive entry that creates a symbolic link to a location outside…
CVE-2026-90954High· 7.8A flaw was found in BusyBox's dpkg-deb archive extraction
A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .…
CVE-2026-97790Medium· 5.5Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally.
Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally.
CVE-2026-96911High· 7.8Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVE-2026-96243High· 7.8Improper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges locally.
Improper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges locally.
CVE-2026-96231High· 7.8Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-96225High· 7.8Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.
CVE-2026-88191High· 7.8Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
CVE-2026-88133High· 7.8Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally.
Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally.
CVE-2026-88072High· 7.8Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally.
Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally.
CVE-2026-85849High· 7.8Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
CVE-2026-85343High· 7.8Improper link resolution before file access ('link following') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
Improper link resolution before file access ('link following') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
CVE-2026-83933Medium· 5.5Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclose information locally.
Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclose information locally.