CWE-61

High likelihood

UNIX Symbolic Link (Symlink) Following

Parent: CWE-59 - Improper Link Resolution Before File Access ('Link Following')

The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

158 vulnerabilities with CWE-61
CVE-2026-6475 HIGH
PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice
CVSS 8.8
CVE-2026-7819 HIGH
pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write
CVSS 8.1
CVE-2026-29203 HIGH
cPanel 11.86.0.0-11.136.0.8 - Authenticated Local Privilege Escalation via Symlink Following
CVSS 8.8
CVE-2026-42275 HIGH
zrok: WebDAV drive backend follows symlinks outside DriveRoot, enabling host filesystem read/write
CVSS 8.7
CVE-2026-31893 MEDIUM
Tunnelblick arbitrary file read via symlink following in tunnelblickd
CVSS 5.5
CVE-2026-7832 HIGH
IObit Advanced SystemCare Service ASC.exe symlink
CVSS 7.0
CVE-2026-43570 MEDIUM
OpenClaw 2026.3.22 < 2026.4.5 - Symlink Traversal in Remote Marketplace Repository Path Handling
CVSS 6.5
CVE-2026-7397 MEDIUM
NousResearch hermes-agent file_tools.py _check_sensitive_path symlink
CVSS 4.4
CVE-2026-41326 HIGH
Kata Containers: CopyFile Policy Subversion via Symlinks
CVSS 8.2
CVE-2026-35372 MEDIUM
uutils coreutils ln Security Bypass via Improper Handling of the --no-dereference Flag
CVSS 5.0
CVE-2026-39861 CRITICAL
Claude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside Workspace
CVSS 10.0
CVE-2026-28684 MEDIUM
python-dotenv: Symlink following in set_key allows arbitrary file overwrite via cross-device rename fallback
CVSS 6.6
CVE-2026-40354 LOW
Flatpak xdg-desktop-portal <1.20.4 - Privilege Escalation
CVSS 2.9
CVE-2026-35632 HIGH
OpenClaw < 2026.2.22 - Symlink Traversal via IDENTITY.md appendFile in agents.create/update
CVSS 7.1
CVE-2026-21916 HIGH
Junos OS: A low privileged user can escalate their privileges so that they can login as root
CVSS 7.3
CVE-2026-39860 CRITICAL
Nix sandbox escape: file write via symlink at FOD `.tmp` copy destination
CVSS 9.0
CVE-2026-35525 HIGH
LiquidJS <10.25.3 Symlinked Templates - Root Restriction Bypass
CVSS 7.5
CVE-2026-34078 CRITICAL
Flatpak <1.16.4 sandbox-expose Symlinks - Sandbox Escape
CVSS 10.0
CVE-2026-34447 MEDIUM
ONNX: External Data Symlink Traversal
CVSS 5.5
CVE-2026-34446 MEDIUM
ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load
CVSS 4.7
CVE-2026-27489 HIGH
ONNX: Path Traversal via Symlink
CVSS 7.5
CVE-2026-22767 HIGH
Dell AppSync 4.6.0 - Symlink Following
CVSS 7.3
CVE-2026-33711 HIGH
Incus vulnerable to local privilege escalation through VM screenshot path
CVSS 7.8
CVE-2026-20694 MEDIUM
iOS and iPadOS < 26.3 - Unauthorized Data Access via Symlink Handling
CVSS 5.5
CVE-2026-33056 MEDIUM
tar-rs: unpack_in can chmod arbitrary directories by following symlinks
CVSS 6.5
Details
Vulnerabilities 158
Exploit Likelihood High
Links
MITRE CWE Entry Search this CWE With Exploits