115
Reference Description
https://www.cve.org/CVERecord?id=CVE-2000-0342
CVE-2001-1042 FTP server allows remote attackers to read arbitrary files and directories by
uploading a .lnk (link) file that points to the target file.
https://www.cve.org/CVERecord?id=CVE-2001-1042
CVE-2001-1043 FTP server allows remote attackers to read arbitrary files and directories by
uploading a .lnk (link) file that points to the target file.
https://www.cve.org/CVERecord?id=CVE-2001-1043
CVE-2005-0587 Browser allows remote malicious web sites to overwrite arbitrary files by
tricking the user into downloading a .LNK (link) file twice, which overwrites the
file that was referenced in the first .LNK file.
https://www.cve.org/CVERecord?id=CVE-2005-0587
CVE-2001-1386 ".LNK." - .LNK with trailing dot
https://www.cve.org/CVERecord?id=CVE-2001-1386
CVE-2003-1233 Rootkits can bypass file access restrictions to Windows kernel directories
using NtCreateSymbolicLinkObject function to create symbolic link
https://www.cve.org/CVERecord?id=CVE-2003-1233
CVE-2002-0725 File system allows local attackers to hide file usage activities via a hard link to
the target file, which causes the link to be recorded in the audit trail instead of
the target file.
https://www.cve.org/CVERecord?id=CVE-2002-0725
CVE-2003-0844 Web server plugin allows local users to overwrite arbitrary files via a symlink
attack on predictable temporary filenames.
https://www.cve.org/CVERecord?id=CVE-2003-0844
CVE-2015-3629 A Libcontainer used in Docker Engine allows local users to escape
containerization and write to an arbitrary file on the host system via a symlink
attack in an image when respawning a container.
https://www.cve.org/CVERecord?id=CVE-2015-3629
CVE-2021-21272 "Zip Slip" vulnerability in Go-based Open Container Initiative (OCI) registries
product allows writing arbitrary files outside intended directory via symbolic
links or hard links in a gzipped tarball.
https://www.cve.org/CVERecord?id=CVE-2021-21272
CVE-2020-27833 "Zip Slip" vulnerability in container management product allows writing
arbitrary files outside intended directory via a container image (.tar format)
with filenames that are symbolic links that point to other files within the same
tar file; however, the files being pointed to can also be symbolic links to
destinations outside the intended directory, bypassing the initial check.
https://www.cve.org/CVERecord?id=CVE-2020-27833
Functional Areas
• File Processing
Affected Resources
• File or Directory
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 635 Weaknesses Originally Used by NVD from 2008 to 2016 635 2552
MemberOf 743 CERT C Secure Coding Standard (2008) Chapter 10 -
Input Output (FIO)
734 2347
CWE Version 4.14
CWE-61: UNIX Symbolic Link (Symlink) Following
CWE-61: UNIX Symbolic Link (Symlink) Following