CWE-61: UNIX Symbolic Link (Symlink) Following

参考: CVE-1999-1386

Some versions of Perl follow symbolic links when running with the -e option, which allows local users to overwrite arbitrary files via a symlink attack.

参考: CVE-2000-1178

Text editor follows symbolic links when creating a rescue copy during an abnormal exit, which allows local users to overwrite the files of other users.

参考: CVE-2004-0217

Antivirus update allows local users to create or append to arbitrary files via a symlink attack on a logfile.

参考: CVE-2003-0517

Symlink attack allows local users to overwrite files.

参考: CVE-2004-0689

Possible interesting example

参考: CVE-2005-1879

Second-order symlink vulnerabilities

参考: CVE-2005-1880

Second-order symlink vulnerabilities

参考: CVE-2005-1916

Symlink in Python program

参考: CVE-2000-0972

Setuid product allows file reading by replacing a file being edited with a symlink to the targeted file, leaking the result in error messages when parsing fails.

参考: CVE-2005-0824

Signal causes a dump that follows symlinks.

参考: CVE-2015-3629

A Libcontainer used in Docker Engine allows local users to escape containerization and write to an arbitrary file on the host system via a symlink attack in an image when respawning a container.

参考: CVE-2020-26277

In a MySQL database deployment tool, users may craft a maliciously packaged tarball that contains symlinks to files external to the target and once unpacked, will execute.

参考: CVE-2021-21272

"Zip Slip" vulnerability in Go-based Open Container Initiative (OCI) registries product allows writing arbitrary files outside intended directory via symbolic links or hard links in a gzipped tarball.