CWE-61 · File and Path Handling
UNIX Symbolic Link (Symlink) Following
189CVEs
1exploited
0with a public check
0likely (EPSS 10%+)
SortMost likely exploited
189 CVEs with CWE-61 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2026-54420In CISA KEVExploitedLiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hostin…LiteSpeed Technologies · cPanel Plugin · CVSS 8.5 · 2026-06-14 | 8.5 | 1.4% | 2026-06-14 |
| CVE-2024-28189Judge0 vulnerable to Sandbox Escape Patch Bypass via chown running on Symbolic Linkjudge0 · judge0 · CVSS 10 · 2024-04-18 | 10.0 | 7.2% | 2024-04-18 |
| CVE-2024-28185Judge0 vulnerable to Sandbox Escape via Symbolic Linkjudge0 · judge0 · CVSS 10 · 2024-04-18 | 10.0 | 7.1% | 2024-04-18 |
| CVE-2019-11249kubectl cp allows symlink directory traversalKubernetes · Kubernetes · CVSS 4.8 · 2019-08-29 | 4.8 | 3.7% | 2019-08-29 |
| CVE-2019-11246kubectl cp allows symlink directory traversalKubernetes · Kubernetes · CVSS 6.4 · 2019-08-29 | 6.4 | 3.6% | 2019-08-29 |
| CVE-2019-16775Unauthorized File Access in npm CLI before before version 6.13.3npm · cli · CVSS 7.7 · 2019-12-13 | 7.7 | 2.9% | 2019-12-13 |
| CVE-2022-3592A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote use…Samba · samba · CVSS 6.5 · 2023-01-12 | 6.5 | 2.8% | 2023-01-12 |
| CVE-2019-11251kubectl cp allows symlink directory traversalKubernetes · Kubernetes · CVSS 4.8 · 2020-02-03 | 4.8 | 2.6% | 2020-02-03 |
| CVE-2021-4287ReFirm Labs binwalk Archive Extraction extractor.py symlinkReFirm Labs · binwalk · CVSS 5 · 2022-12-27 | 5.0 | 2.1% | 2022-12-27 |
| CVE-2026-34078Flatpak has a complete sandbox escape leading to host file access and code execution in the host contextflatpak · flatpak · CVSS 9 · 2026-04-07 | 9.0 | 1.7% | 2026-04-07 |
| CVE-2021-32518QSAN Storage Manager - UNIX Symbolic Link (Symlink) FollowingQSAN · Storage Manager · CVSS 7.5 · 2021-07-07 | 7.5 | 1.7% | 2021-07-07 |
| CVE-2021-32509QSAN Storage Manager - UNIX Symbolic Link (Symlink) Following via FileviewDoc functionQSAN · Storage Manager · CVSS 6.5 · 2021-07-07 | 6.5 | 1.3% | 2021-07-07 |
| CVE-2021-32508QSAN Storage Manager - UNIX Symbolic Link (Symlink) Following via FileStreaming functionQSAN · Storage Manager · CVSS 6.5 · 2021-07-07 | 6.5 | 1.3% | 2021-07-07 |
| CVE-2021-1145Cisco StarOS for Cisco ASR 5000 Series Routers Arbitrary File Read VulnerabilityCisco · Cisco ASR 5000 Series Software · CVSS 6.5 · 2021-01-13 | 6.5 | 1.3% | 2021-01-13 |
| CVE-2025-31133runc container escape via "masked path" abuse due to mount race conditionsopencontainers · runc · CVSS 7.3 · 2025-11-06 | 7.3 | 1.2% | 2025-11-06 |
| CVE-2022-24904Symlink following allows leaking out-of-bound manifests and JSON files from Argo CD repo-serverargoproj · argo-cd · CVSS 4.3 · 2022-05-20 | 4.3 | 1.2% | 2022-05-20 |
| CVE-2017-14798local privilege escalation in SUSE postgresql init scriptsuse · postgresql-init · CVSS 7.3 · 2018-03-01 | 7.3 | 1.0% | 2018-03-01 |
| CVE-2026-91099HP Linux Imaging and Printing (HPLIP) Software– Multiple VulnerabilitiesHP Inc. · HP Linux Imaging and Printing Software (HPLIP) · CVSS 5.1 · 2026-09-16 | 5.1 | 1.0% | 2026-09-16 |
| CVE-2026-56748Authenticated RCE via Symlink Following in Cribl Stream Pack Git ImportCribl · Cribl Stream · CVSS 8.8 · 2026-07-27 | 8.8 | 0.9% | 2026-07-27 |
| CVE-2025-55345Unsafe symlink following in restricted workspace-write sandbox leads to RCENo vendor recorded · CVSS 8.8 · 2025-08-13 | 8.8 | 0.9% | 2025-08-13 |
| CVE-2022-31036Symlink following allows leaking out-of-bounds YAML files from Argo CD repo-serverargoproj · argo-cd · CVSS 4.3 · 2022-06-27 | 4.3 | 0.9% | 2022-06-27 |
| CVE-2024-54148Gogs has a Path Traversal in file editing UIgogs · gogs · CVSS 9.8 · 2024-12-23 | 9.8 | 0.9% | 2024-12-23 |
| CVE-2025-52565container escape due to /dev/console mount and related racesopencontainers · runc · CVSS 8.4 · 2025-11-06 | 8.4 | 0.8% | 2025-11-06 |
| CVE-2025-52881runc: LSM labels can be bypassed with malicious config using dummy procfs filesopencontainers · runc · CVSS 7.3 · 2025-11-06 | 7.3 | 0.8% | 2025-11-06 |
| CVE-2024-54661readline.sh in socat before1.8.0.2 relies on the /tmp/$USER/stderr2 file.dest-unreach · socat · CVSS 9.8 · 2024-12-04 | 9.8 | 0.8% | 2024-12-04 |
| CVE-2025-3047Path Traversal in AWS SAM CLI allows file copy to build containerAWS · AWS Serverless Application Model Command Line Interface · CVSS 6.5 · 2025-03-31 | 6.5 | 0.8% | 2025-03-31 |
| CVE-2024-22014An issue discovered in 360 Total Security Antivirus through 11.0.0.1061 for Windows allows attackers to gain escalated privileges via Symbolic Link Follow to Arbitrary File Delete.360totalsecurity · 360 Total Security · CVSS 8.8 · 2024-04-15 | 8.8 | 0.8% | 2024-04-15 |
| CVE-2026-27976Zed Extension Sandbox Escape via Tar Symlink Followingzed-industries · zed · CVSS 8.8 · 2026-02-25 | 8.8 | 0.7% | 2026-02-25 |
| CVE-2025-3048Path Traversal in AWS SAM CLI allows file copy to local cacheAWS · AWS Serverless Application Model Command Line Interface · CVSS 6.5 · 2025-03-31 | 6.5 | 0.7% | 2025-03-31 |
| CVE-2026-63125Incus vulnerable to root RCE via image backup.yaml symlinklxc · incus · CVSS 9.9 · 2026-08-21 | 9.9 | 0.7% | 2026-08-21 |
| CVE-2026-55447Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploitlangflow-ai · langflow · CVSS 9.6 · 2026-06-23 | 9.6 | 0.7% | 2026-06-23 |
| CVE-2024-42367In aiohttp, compressed files as symlinks are not protected from path traversalaio-libs · aiohttp · CVSS 4.8 · 2024-08-09 | 4.8 | 0.7% | 2024-08-09 |
| CVE-2026-55168Runtipi: Authenticated arbitrary file write via backup restore symlink plantingruntipi · runtipi · CVSS 6.5 · 2026-08-21 | 6.5 | 0.6% | 2026-08-21 |
| CVE-2025-23394daily-backup.sh script in cyrus-imapd allows escalation from cyrus to rootSUSE · openSUSE Tumbleweed · CVSS 9.8 · 2025-05-26 | 9.8 | 0.6% | 2025-05-26 |
| CVE-2021-39134UNIX Symbolic Link (Symlink) Following in @npmcli/arboristnpm · arborist · CVSS 8.2 · 2021-08-31 | 8.2 | 0.6% | 2021-08-31 |
| CVE-2026-49248OneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untartheonedev · onedev · CVSS 8.3 · 2026-06-18 | 8.3 | 0.6% | 2026-06-18 |
| CVE-2021-39135UNIX Symbolic Link (Symlink) Following in @npmcli/arboristnpm · arborist · CVSS 8.2 · 2021-08-31 | 8.2 | 0.6% | 2021-08-31 |
| CVE-2024-47515Pagure: generate_archive() follows symbolic links in temporary clonesNo vendor recorded · CVSS 8.1 · 2024-12-24 | 8.1 | 0.6% | 2024-12-24 |
| CVE-2024-52535Dell SupportAssist for Home PCs versions 4.6.1 and prior and Dell SupportAssist for Business PCs versions 4.5.0 and prior, contain a symbolic link (symlink) attack vulnerability i…Dell · SupportAssist for Home PCs · CVSS 7.1 · 2024-12-25 | 7.1 | 0.6% | 2024-12-25 |
| CVE-2026-24047@backstage/cli-common has a possible `resolveSafeChildPath` Symlink Chain Bypassbackstage · backstage · CVSS 6.3 · 2026-01-21 | 6.3 | 0.5% | 2026-01-21 |
| CVE-2020-8019syslog-ng: Local privilege escalation from new to root in %postSUSE · SUSE Linux Enterprise Debuginfo 11-SP3 · CVSS 7.7 · 2020-06-29 | 7.7 | 0.5% | 2020-06-29 |
| CVE-2025-68937Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository symlink destinations for…Forgejo · Forgejo · CVSS 9.5 · 2025-12-25 | 9.5 | 0.5% | 2025-12-25 |
| CVE-2020-8014kopano-python-services: Local privilege escalation from kopano to root in kopano-spamd subpackageopenSUSE · openSUSE Leap 15.1 · CVSS 7.7 · 2020-06-29 | 7.7 | 0.5% | 2020-06-29 |
| CVE-2026-29203A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS o…WebPros · cPanel · CVSS 8.8 · 2026-05-08 | 8.8 | 0.5% | 2026-05-08 |
| CVE-2026-111433UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux. This vulnerability is associated with program file src/daemon/modules/spec/specs_mount.c. This i…openEuler · iSulad · CVSS 8.6 · 2026-11-12 | 8.6 | 0.5% | 2026-11-12 |
| CVE-2025-24886pwn.college has Symlink LFI in Dojo repospwncollege · dojo · CVSS 7.7 · 2025-01-30 | 7.7 | 0.5% | 2025-01-30 |
| CVE-2024-45418Zoom Apps for macOS - Symbolic Link FollowingZoom Communications, Inc · Zoom Apps for macOS · CVSS 5.4 · 2025-02-25 | 5.4 | 0.5% | 2025-02-25 |
| CVE-2026-25724Claude Code Has Permission Deny Bypass Through Symbolic Linksanthropics · claude-code · CVSS 2.3 · 2026-02-06 | 2.3 | 0.5% | 2026-02-06 |
| CVE-2026-57825In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files.OCaml · opam · CVSS 5.7 · 2026-09-09 | 5.7 | 0.5% | 2026-09-09 |
| CVE-2026-97024Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etcRed Hat · Red Hat Enterprise Linux 10 · CVSS 7.1 · 2026-09-29 | 7.1 | 0.5% | 2026-09-29 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.