CWE-59 · Improper Link Resolution Before File Access (page 4)
Page 4 of 17 — CVEs classified under CWE-59, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-64437 | Medium | 5.0 | 2025-11-07 | KubeVirt is a virtual machine management add-on for Kubernetes. In versions before 1.5.3 and 1.6.1, the virt-handler does not verify whether the launcher-sock… |
CVE-2025-12418 | | 2025-11-07 | Potential Denial of Service issue in all supported versions of Revenera InstallShield version 2025 R1, 2024 R2, 2023 R2, and prior. When e.g., a local administ… | |
CVE-2025-43448 | Medium | 6.3 | 2025-11-04 | This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15… |
CVE-2025-43446 | Medium | 5.5 | 2025-11-04 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may b… |
CVE-2025-43395 | Low | 3.3 | 2025-11-04 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be… |
CVE-2025-43394 | Medium | 5.5 | 2025-11-04 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.1. An app may be… |
CVE-2025-43379 | Medium | 5.5 | 2025-11-04 | This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macO… |
CVE-2025-43288 | Medium | 5.5 | 2025-11-04 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An app may be able to bypass Privacy… |
CVE-2025-9871 | High | 7.8 | 2025-10-29 | Razer Synapse 3 Chroma Connect Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on aff… |
CVE-2025-9870 | High | 7.8 | 2025-10-29 | Razer Synapse 3 RazerPhilipsHueUninstall Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privile… |
CVE-2025-9869 | High | 7.8 | 2025-10-29 | Razer Synapse 3 Macro Module Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affec… |
CVE-2025-12341 | High | 7.8 | 2025-10-28 | A vulnerability was detected in ermig1979 AntiDupl up to 2.3.12. Impacted is an unknown function of the file AntiDupl.NET.WinForms.exe of the component Delete… |
CVE-2025-26625 | | 2025-10-17 | Git LFS is a Git extension for versioning large files. In Git LFS versions 0.5.2 through 3.7.0, when populating a Git repository's working tree with the conten… | |
CVE-2025-59281 | High | 7.8 | 2025-10-14 | Improper link resolution before file access ('link following') in XBox Gaming Services allows an authorized attacker to elevate privileges locally. |
CVE-2025-59241 | High | 7.8 | 2025-10-14 | Improper link resolution before file access ('link following') in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate pri… |
CVE-2025-55247 | High | 7.3 | 2025-10-14 | Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally. |
CVE-2025-62363 | High | 7.8 | 2025-10-13 | yt-grabber-tui is a terminal user interface application for downloading videos. In versions before 1.0-rc, the application allows users to configure the path t… |
CVE-2025-62364 | Medium | 6.2 | 2025-10-13 | text-generation-webui is an open-source web interface for running Large Language Models. In versions through 3.13, a Local File Inclusion vulnerability exists… |
CVE-2025-9968 | | 2025-10-13 | A link following vulnerability exists in the UnifyScanner component of Armoury Crate. This vulnerability may be triggered by creating a specially crafted junct… | |
CVE-2025-11190 | Medium | 5.4 | 2025-10-10 | The Kiwire Captive Portal contains an open redirection issue via the login-url parameter, allowing an attacker to redirect users to an attacker controlled webs… |
CVE-2025-11489 | Medium | 4.5 | 2025-10-08 | A security vulnerability has been detected in wonderwhy-er DesktopCommanderMCP up to 0.2.13. This vulnerability affects the function isPathAllowed of the file… |
CVE-2025-11462 | High | 7.8 | 2025-10-07 | Improper Link Resolution Before File Access in the AWS VPN Client for macOS versions 1.3.2- 5.2.0 allows a local user to execute code with elevated privileges… |
CVE-2025-41421 | Medium | 4.7 | 2025-10-01 | Improper handling of symbolic links in the TeamViewer Full Client and Host for Windows — in versions prior to 15.70 of TeamViewer Remote and Tensor — allows an… |
CVE-2025-34194 | High | 7.8 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (Windows client deployments)… |
CVE-2025-34191 | High | 8.4 | 2025-09-19 | Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (macOS/Linux client deployments) cont… |
CVE-2025-55317 | High | 7.8 | 2025-09-09 | Improper link resolution before file access ('link following') in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally. |
CVE-2025-55245 | High | 7.8 | 2025-09-09 | Improper link resolution before file access ('link following') in Xbox allows an authorized attacker to elevate privileges locally. |
CVE-2025-58373 | Medium | 5.5 | 2025-09-05 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Versions 3.25.23 and below contain a vulnerability where .rooignore protections… |
CVE-2025-43726 | Medium | 6.7 | 2025-09-02 | Dell Alienware Command Center 5.x (AWCC), versions prior to 5.10.2.0, contains an Improper Link Resolution Before File Access ('Link Following')" vulnerability… |
CVE-2024-54554 | Medium | 5.5 | 2025-08-29 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.1. An app may be able to access sensitive user data. |
CVE-2025-57749 | Medium | 6.5 | 2025-08-20 | n8n is a workflow automation platform. Before 1.106.0, a symlink traversal vulnerability was discovered in the Read/Write File node in n8n. While the node atte… |
CVE-2025-8612 | High | 7.3 | 2025-08-20 | AOMEI Backupper Workstation Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affect… |
CVE-2025-5296 | High | 7.3 | 2025-08-18 | CWE-59: Improper Link Resolution Before File Access ('Link Following') vulnerability exists that could cause arbitrary data to be written to protected locatio… |
CVE-2025-8959 | High | 7.5 | 2025-08-15 | HashiCorp's go-getter library subdirectory download feature is vulnerable to symlink attacks leading to unauthorized read access beyond the designated director… |
CVE-2025-43490 | | 2025-08-15 | A potential security vulnerability has been identified in the HPAudioAnalytics service included in the HP Hotkey Support software, which might allow escalation… | |
CVE-2025-55188 | Low | 3.6 | 2025-08-08 | 7-Zip before 25.01 does not always properly handle symbolic links during extraction. |
CVE-2025-54798 | Low | 2.5 | 2025-08-07 | tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via… |
CVE-2025-36611 | High | 7.3 | 2025-07-30 | Dell Encryption and Dell Security Management Server, versions prior to 11.11.0, contain an Improper Link Resolution Before File Access ('Link Following') Vulne… |
CVE-2025-43252 | Medium | 6.5 | 2025-07-30 | This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sequoia 15.6. A website may be able to access sensitive… |
CVE-2025-43220 | Critical | 9.8 | 2025-07-30 | This issue was addressed with improved validation of symlinks. This issue is fixed in iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13… |
CVE-2025-23267 | High | 8.5 | 2025-07-17 | NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook, where an attacker could cause a link following by using a speci… |
CVE-2025-7012 | | 2025-07-13 | An issue in Cato Networks' CatoClient for Linux, before version 5.5, allows a local attacker to escalate privileges to root by exploiting improper symbolic lin… | |
CVE-2025-52837 | High | 7.8 | 2025-07-10 | Trend Micro Password Manager (Consumer) version 5.8.0.1327 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow an a… |
CVE-2025-48384 | High | 8.0 | 2025-07-08 | Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to int… |
CVE-2025-49739 | High | 8.8 | 2025-07-08 | Improper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-49738 | High | 7.8 | 2025-07-08 | Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-49680 | High | 7.3 | 2025-07-08 | Improper link resolution before file access ('link following') in Windows Performance Recorder allows an authorized attacker to deny service locally. |
CVE-2025-48820 | High | 7.8 | 2025-07-08 | Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-48799 | High | 7.8 | 2025-07-08 | Improper link resolution before file access ('link following') in Windows Update Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-21195 | Medium | 6.0 | 2025-07-08 | Improper link resolution before file access ('link following') in Service Fabric allows an authorized attacker to elevate privileges locally. |
CVE-2025-41668 | High | 8.8 | 2025-07-08 | A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute acc… |
CVE-2025-41667 | High | 8.8 | 2025-07-08 | A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file… |
CVE-2025-41666 | High | 8.8 | 2025-07-08 | A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the dev… |
CVE-2025-53109 | | 2025-07-02 | Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). Versions of Filesystem prior to 0.6.4 or 2025… | |
CVE-2025-3771 | High | 7.1 | 2025-06-26 | A path or symbolic link manipulation vulnerability in SIR 1.0.3 and prior versions allows an authenticated non-admin local user to overwrite system files with… |
CVE-2025-52936 | | 2025-06-23 | Improper Link Resolution Before File Access ('Link Following') vulnerability in yrutschle sslh.This issue affects sslh: before 2.2.2. | |
CVE-2025-30642 | Medium | 5.5 | 2025-06-17 | A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to create a denial of service (DoS) situation on affected… |
CVE-2025-30641 | High | 7.8 | 2025-06-17 | A link following vulnerability in the anti-malware solution portion of Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privilege… |
CVE-2025-30640 | High | 7.8 | 2025-06-17 | A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations. Pleas… |
CVE-2025-49157 | High | 7.8 | 2025-06-17 | A link following vulnerability in the Trend Micro Apex One Damage Cleanup Engine could allow a local attacker to escalation privileges on affected installation… |
CVE-2025-49156 | High | 7.0 | 2025-06-17 | A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalation privileges on affected installations. Plea… |
CVE-2025-0913 | Medium | 5.5 | 2025-06-11 | os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile wi… |
CVE-2025-33075 | High | 7.8 | 2025-06-10 | Improper link resolution before file access ('link following') in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2025-32721 | High | 7.3 | 2025-06-10 | Improper link resolution before file access ('link following') in Windows Recovery Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-5474 | High | 7.3 | 2025-06-06 | 2BrightSparks SyncBackFree Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affecte… |
CVE-2025-36564 | High | 7.8 | 2025-06-03 | Dell Encryption Admin Utilities versions prior to 11.10.2 contain an Improper Link Resolution vulnerability. A local malicious user could potentially exploit t… |
CVE-2024-54189 | High | 7.8 | 2025-06-03 | A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtu… |
CVE-2024-52561 | High | 7.8 | 2025-06-03 | A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740). When a snapshot of a virtu… |
CVE-2024-36486 | High | 7.8 | 2025-06-03 | A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740). When… |
CVE-2024-11857 | High | 7.8 | 2025-06-02 | Bluetooth HCI Adaptor from Realtek has a Link Following vulnerability. Local attackers with regular privileges can create a symbolic link with the same name as… |
CVE-2025-31198 | Medium | 5.5 | 2025-05-29 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A path han… |
CVE-2025-47181 | High | 8.8 | 2025-05-22 | Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally. |
CVE-2025-2102 | | 2025-05-21 | Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Passwordless on Windows allows Privilege Escalation.This issue affects HYP… | |
CVE-2025-3908 | Medium | 6.2 | 2025-05-19 | The configuration initialization tool in OpenVPN 3 Linux v20 through v24 on Linux allows a local attacker to use symlinks pointing at an arbitrary directory wh… |
CVE-2025-4211 | | 2025-05-16 | Improper Link Resolution Before File Access ('Link Following') vulnerability in QFileSystemEngine in the Qt corelib module on Windows which potentially allows… | |
CVE-2025-20003 | High | 8.2 | 2025-05-13 | Improper link resolution before file access ('Link Following') for some Intel(R) Graphics Driver software installers may allow an authenticated user to potenti… |
CVE-2025-29975 | High | 7.8 | 2025-05-13 | Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-29837 | Medium | 5.5 | 2025-05-13 | Improper link resolution before file access ('link following') in Windows Installer allows an authorized attacker to disclose information locally. |
CVE-2025-1079 | High | 7.8 | 2025-05-12 | Client RCE on macOS and Linux via improper symbolic link resolution in Google Web Designer's preview feature |
CVE-2025-22247 | Medium | 6.1 | 2025-05-12 | VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to… |
CVE-2024-9524 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in System Speedup Service in Avira Operations GmbH Avira Prime Version 1.1.96.2 on Windows 10 x64 allow… |
CVE-2024-13962 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in TuneupSvc in Gen Digital Inc. Avast Cleanup Premium Version 24.2.16593.17810 on Windows 10 Pro x64 a… |
CVE-2024-13961 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in TuneupSvc in Avast Cleanup Premium Version 24.2.16593.17810 on Windows 10 Pro x64 allows local attac… |
CVE-2024-13960 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in TuneUp Service in AVG TuneUp Version 23.4 (build 15592) on Windows 10 allows local attackers to esca… |
CVE-2024-13959 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in TuneupSvc.exe in AVG TuneUp 24.2.16593.9844 on Windows allows local attackers to escalate privileges… |
CVE-2024-13944 | High | 7.8 | 2025-05-09 | Link Following Local Privilege Escalation Vulnerability in NortonUtilitiesSvc in Norton Utilities Ultimate Version 24.2.16862.6344 on Windows 10 Pro x64 allows… |
CVE-2024-13759 | High | 7.8 | 2025-05-09 | Local Privilege Escalation in Avira.Spotlight.Service.exe in Avira Prime 1.1.96.2 on Windows 10 x64 allows local attackers to gain system-level privileges via… |
CVE-2025-3224 | High | 7.8 | 2025-04-28 | A vulnerability in the update process of Docker Desktop for Windows versions prior to 4.41.0 could allow a local, low-privileged attacker to escalate privilege… |
CVE-2025-1697 | High | 7.8 | 2025-04-18 | A potential security vulnerability has been identified in the HP Touchpoint Analytics Service for certain HP PC products with versions prior to 4.2.2439. This… |
CVE-2025-32817 | Medium | 6.1 | 2025-04-16 | A Improper Link Resolution vulnerability (CWE-59) in the SonicWall Connect Tunnel Windows (32 and 64 bit) client, this results in unauthorized file overwrite… |
CVE-2025-29983 | Medium | 6.7 | 2025-04-15 | Dell Trusted Device, versions prior to 7.0.3.0, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attac… |
CVE-2025-23010 | High | 7.2 | 2025-04-10 | An Improper Link Resolution Before File Access ('Link Following') vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which allows an attacke… |
CVE-2025-27727 | High | 7.8 | 2025-04-08 | Improper link resolution before file access ('link following') in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2025-21204 | High | 7.8 | 2025-04-08 | Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally. |
CVE-2025-30457 | Critical | 9.8 | 2025-03-31 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A maliciou… |
CVE-2025-24278 | Medium | 5.5 | 2025-03-31 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may… |
CVE-2025-24242 | Medium | 4.4 | 2025-03-31 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4. An app with root privileges may be able to access priva… |
CVE-2025-30371 | | 2025-03-28 | Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerable to circumvention… | |
CVE-2024-12905 | High | 7.5 | 2025-03-27 | An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). This vuln… |
CVE-2025-29795 | High | 7.8 | 2025-03-23 | Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally. |