CWE-59: Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Consequences

• Confidentiality, Integrity, Access Control: Read Files or Directories, Modify Files or Directories, Bypass Protection Mechanism
• Other: Execute Unauthorized Code or Commands

How to prevent it

• Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

Recent advisories

• GHSA-hjqx-j4rw-g7xv — zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.
• GHSA-4vjg-vx72-qq4g — systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net
• GHSA-9j6q-wvj5-jgjg — filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker
• GHSA-j8f7-rjxc-mr56 — filelock: ReadWriteLock follows a symlink at the lock path into SQLite
• GHSA-crv4-6mhj-j5jh — filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
• GHSA-v4x8-3wr5-3wq8 — filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
• GHSA-gq48-pqfc-9p58 — GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree
• GHSA-2j93-m82w-73j2 — Microsoft Security Advisory CVE-2026-96231 - .NET and Visual Studio Elevation of Privilege Vulnerability
• GHSA-w6wh-p4g7-mpj2 — Microsoft Security Advisory CVE-2026-96225 - .NET and Visual Studio Elevation of Privilege Vulnerability
• GHSA-p8v3-89rh-jxc7 — Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied
• GHSA-xvgh-hmx8-9xxf — Backstage: Improper task state validation in Scaffolder backend
• GHSA-f8g7-2xjc-7mfh — rclone: Directory metadata (chmod/chown/chtimes) applied through a planted symlink in rclone local --links escapes the destination
• CVE-2026-81963 — Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
• GHSA-2rx9-3g3h-c2jv — pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project
• GHSA-f794-5jv7-7672 — NLTK: Downloader.download follows hardlinks and overwrites outside-root files

All advisories for CWE-59