CWE-61

High likelihood

UNIX Symbolic Link (Symlink) Following

Parent: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

138 vulnerabilities with CWE-61
CVE-2026-27489 HIGH
ONNX: Path Traversal via Symlink
CVSS 7.5
CVE-2026-22767 HIGH
Dell AppSync 4.6.0 - Symlink Following
CVSS 7.3
CVE-2026-33711 HIGH
Incus vulnerable to local privilege escalation through VM screenshot path
CVSS 7.8
CVE-2026-20694 MEDIUM
iOS and iPadOS < 26.3 - Unauthorized Data Access via Symlink Handling
CVSS 5.5
CVE-2026-33056 MEDIUM
tar-rs: unpack_in can chmod arbitrary directories by following symlinks
CVSS 6.5
CVE-2026-24018 HIGH
FortiClientLinux 7.2.2-7.4.4 - Privilege Escalation
CVSS 7.8
CVE-2026-27976 HIGH
zed < 0.224.4 - Arbitrary File Write via Symlink in Extension Tar Extraction
CVSS 8.8
CVE-2026-27485 MEDIUM
OpenClaw <=2026.2.17 - Info Disclosure
CVSS 4.4
CVE-2026-25724 HIGH
Claude Code <2.1.7 - Info Disclosure
CVSS 7.5
CVE-2026-1386 MEDIUM
Firecracker <1.13.2-1.14.1 - Privilege Escalation
CVSS 6.0
CVE-2026-24047 MEDIUM
@backstage/cli-common < 0.1.17 - Path Traversal via Symlink Chain Bypass
CVSS 6.3
CVE-2026-23986 HIGH
copier < 9.11.2 - Arbitrary File Write via Symlink Following with _preserve_symlinks
CVSS 7.1
CVE-2026-23968 MEDIUM
copier < 9.11.2 - Arbitrary File Access via Symlink Following
CVSS 5.5
CVE-2025-43278 MEDIUM
macOS < 15.4 - Unprotected User Data Exposure via Symlink Handling
CVSS 5.5
CVE-2025-68937 CRITICAL
Forgejo 11.0.0-11.0.6 and 12.0.0-13.0.1 - Arbitrary File Write via Template Repository Symlink Handling
CVE-2025-33225 HIGH
NVIDIA Resiliency Extension - Privilege Escalation
CVSS 8.4
CVE-2025-14693 MEDIUM
Ugreen DH2100+ <5.3.0 - Symlink Following
CVSS 6.2
CVE-2025-67487 HIGH
static-web-server < 2.40.1 - Symbolic Link Following
CVSS 8.6
CVE-2025-66431 HIGH
WebPros Plesk <18.0.73.5, <18.0.74.2 - Authenticated RCE
CVSS 7.8
CVE-2025-65105 MEDIUM
Apptainer <1.4.5 - Privilege Escalation
CVSS 4.5
CVE-2025-64750 MEDIUM
SingularityCE and SingularityPRO - LSM Label Redirect Restriction Bypass
CVSS 4.5
CVE-2025-62724 MEDIUM
Open OnDemand <4.0.8, <3.1.16 - Info Disclosure
CVSS 4.3
CVE-2025-52881 HIGH
runc <1.4.0-rc.2 - Privilege Escalation
CVSS 7.5
CVE-2025-52565 HIGH
runc 1.0.0-rc3-1.2.7 1.3.0-rc.1-1.3.2 1.4.0-rc.1-1.4.0-rc.2 - Symbolic Link Following via Bind-Mount
CVSS 7.5
CVE-2025-31133 HIGH
runc < 1.2.8, 1.3.0-rc.1-1.3.1, 1.4.0-rc.1-1.4.0-rc.2 - Arbitrary Mount Gadget via Insufficient Bind-Mount Verification
CVSS 7.8
Details
Vulnerabilities 138
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits