CWE-59

Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/

BuildKit's cache mount source= selector on Windows Container on Windows (WCOW) workers does not detect NTFS directory ju

PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows networ

to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but

gitoxide before 0.52.1 follows symlinks when reading the worktree .gitmodules file, allowing attackers to inject out-of-

A privilege escalation (PE) vulnerability in the Tencent iOA app thru 210.9.28693.621001 on Windows devices enables a lo

A privilege escalation (PE) vulnerability in the Tencent PC Manager app thru 17.10.28554.205 on Windows devices enables

In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local f

Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive

Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an unauthorized

rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended in

Dell Optimizer, versions prior to 6.3.1, contain an Improper Link Resolution Before File Access ('Link Following') vulne

A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile()

Dell Device Management Agent, versions prior to DDMA 26.05, contain an Improper Link Resolution Before File Access ('Lin

Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attac

Improper link resolution before file access ('link following') in Windows Server Backup allows an authorized attacker to

openssl-encrypt (pip package) before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist s

Backstage is an open framework for building developer portals. Multiple Scaffolder actions and archive extraction utilit

An Improper Link Resolution Before File Access ('Link Following') vulnerability [CWE-59] vulnerability in Fortinet Forti

Zed, a code editor, has a symlink escape vulnerability in versions prior to 0.225.9 in Agent file tools (`read_file`, `e

An issue in the WiseDelfile64.sys component of WiseCleaner Wise Force Deleter 7.3.2 and earlier allows attackers to dele

Tina is a headless content management system. Prior to version 2.2.2, @tinacms/cli recently added lexical path-traversal

Tina is a headless content management system. Prior to version 2.2.2, @tinacms/graphql uses string-based path containmen

During an internal security assessment, a potential vulnerability was discovered in Lenovo Diagnostics and the HardwareS

CodexBar prior to 0.32.0 contains an insecure temporary file handling vulnerability that allows local attackers to acces

acl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(

attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows

OpenClaw versions before 2026.6.9 contain a symlink following vulnerability in the mirror sync feature that allows lower

Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allow

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 vali

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree opera

A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low

An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial V

rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intend

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the int

During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper r

In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_da

NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloa

RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-exi

A security flaw has been discovered in IObit Advanced SystemCare 19. This affects an unknown part of the file ASC.exe of

A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts wr

An Improper link resolution before file access ('link following') vulnerability in the File Shredder module as used in B

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tamperin

During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Le

The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows

openCryptoki is a PKCS#11 library and provides tooling for Linux and AIX. Versions 2.3.2 and above are vulnerable to sym

A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an atta

HashiCorp Consul and Consul Enterprise 1.18.20 up to 1.21.10 and 1.22.4 are vulnerable to arbitrary file read when confi

OpenClaw before 2026.3.31 contains a sandbox escape vulnerability allowing attackers to traverse directory boundaries th