118
Follow the principle of least privilege when assigning access rights to entities in a software
system. Denying access to a file can prevent an attacker from replacing that file with a link to a
sensitive file. Ensure good compartmentalization in the system to provide protected areas that
can be trusted.
Observed Examples
Reference Description
CVE-1999-1386 Some versions of Perl follow symbolic links when running with the -e option,
which allows local users to overwrite arbitrary files via a symlink attack.
https://www.cve.org/CVERecord?id=CVE-1999-1386
CVE-2000-1178 Text editor follows symbolic links when creating a rescue copy during an
abnormal exit, which allows local users to overwrite the files of other users.
https://www.cve.org/CVERecord?id=CVE-2000-1178
CVE-2004-0217 Antivirus update allows local users to create or append to arbitrary files via a
symlink attack on a logfile.
https://www.cve.org/CVERecord?id=CVE-2004-0217
CVE-2003-0517 Symlink attack allows local users to overwrite files.
https://www.cve.org/CVERecord?id=CVE-2003-0517
CVE-2004-0689 Possible interesting example
https://www.cve.org/CVERecord?id=CVE-2004-0689
CVE-2005-1879 Second-order symlink vulnerabilities
https://www.cve.org/CVERecord?id=CVE-2005-1879
CVE-2005-1880 Second-order symlink vulnerabilities
https://www.cve.org/CVERecord?id=CVE-2005-1880
CVE-2005-1916 Symlink in Python program
https://www.cve.org/CVERecord?id=CVE-2005-1916
CVE-2000-0972 Setuid product allows file reading by replacing a file being edited with a symlink
to the targeted file, leaking the result in error messages when parsing fails.
https://www.cve.org/CVERecord?id=CVE-2000-0972
CVE-2005-0824 Signal causes a dump that follows symlinks.
https://www.cve.org/CVERecord?id=CVE-2005-0824
CVE-2015-3629 A Libcontainer used in Docker Engine allows local users to escape
containerization and write to an arbitrary file on the host system via a symlink
attack in an image when respawning a container.
https://www.cve.org/CVERecord?id=CVE-2015-3629
CVE-2020-26277 In a MySQL database deployment tool, users may craft a maliciously
packaged tarball that contains symlinks to files external to the target and once
unpacked, will execute.
https://www.cve.org/CVERecord?id=CVE-2020-26277
CVE-2021-21272 "Zip Slip" vulnerability in Go-based Open Container Initiative (OCI) registries
product allows writing arbitrary files outside intended directory via symbolic
links or hard links in a gzipped tarball.
https://www.cve.org/CVERecord?id=CVE-2021-21272
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 1404 Comprehensive Categorization: File Handling 1400 2529
Notes
Research Gap
CWE Version 4.14
CWE-62: UNIX Hard Link
CWE-62: UNIX Hard Link