CWE-61.

LXC: lxc-copy host-context hostname update follows symlink

• lxc
• Path traversal
• CWE-61

nvm prints the contents of any readable file through a symlinked .nvmrc

• nvm
• Path traversal
• Information disclosure

Malicious client could set xattr value outside of BuildKit state directory

• Moby BuildKit
• CWE-61

NVIDIA Slurm: NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that…

• NVIDIA Slurm
• CWE-61

Pi-hole: arbitrary root file clobber / chmod / disclosure via updatecheck.sh cron following /etc/pihole/versions symlink

• pi-hole
• Path traversal
• CWE-61

zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.

• Path traversal
• CWE-61

>=7.2.0, <9.0.0 · fixed in 9.0.0

Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination

• Red Hat OpenShift Container Platform 4
• Red Hat OpenShift Container Platform 5
• CWE-61

AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink

• AsyncHttpClient async-http-client
• Broken access control
• CWE-61

Import Symlink Following Remote Code Execution Vulnerability in QuMagie

• QNAP Systems Inc. QuMagie
• CWE-61

Symlink creation in qsyncsrv.cgi

• QNAP Systems Inc. Qsync Central
• CWE-61

Filesystem sandbox escape when renaming symlinks with trailing slashes

• CWE-61

>=0.0.0-0, <36.0.18 || >=37.0.0, <48.0.6 || >=49.0.0, <49.0.3 · fixed in 36.0.18, 48.0.6, 49.0.3

denji ngx_cache_purge: ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain…

• denji ngx_cache_purge
• CWE-61

Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied

• Path traversal
• CWE-61

>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074146-a467ed652591 · fixed in 1.9.10-0.20260728074146-a467ed652591

ImageMagick: Policy Bypass in delegate symlink cleanup due to missing check

• ImageMagick
• CWE-61

Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction

• Red Hat OpenShift Serverless
• Red Hat OpenShift Source-to-Image (S2I)
• CWE-61

Arbitrary File Write via Write-Time Symlink Following (TOCTOU) in Claude Code

• @anthropic-ai/claude-code
• Path traversal
• Race condition

Backstage: TechDocs arbitrary file read via mkdocs snippets

• backstage
• plugin-techdocs-node
• Path traversal
• CWE-61

gpgtar in GnuPG before 2.5.19 can allow file overwrite via crafted data in an archive.

• GnuPG
• CWE-61

Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections

• Path traversal
• CWE-61

>=0.24.0, <1.2.8 · fixed in 1.2.8

Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-61

Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-61

Language Servers for AWS vulnerable to arbitrary file write

• CWE-61

<0.0.117 · fixed in 0.0.117

Flatpak: In Flatpak before 1.18.1, the revokefs writer…

• Flatpak
• CWE-61

Flatpak: In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so…

• Flatpak
• CWE-61

Cockpit-files: cockpit-files: arbitrary file ownership change via symlink following in privileged paste

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• CWE-61

HP Linux Imaging and Printing (HPLIP) Software– Multiple Vulnerabilities

• HP Inc. HP Linux Imaging and Printing Software (HPLIP)
• CWE-61

Flatpak: In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write…

• Flatpak
• CWE-61

Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-61

OCaml opam: In the opam package before 2.5.2 for OCaml…

• OCaml opam
• CWE-61

NLTK: Downloader.download follows hardlinks and overwrites outside-root files

• Path traversal
• CWE-61

<3.10.3 · fixed in 3.10.3

Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink) Following vulnerability.

• Dell Power Protect Cyber Recovery
• Dell Cyber Recovery
• CWE-61

Predictable temporary file in /tmp allows symlink attack in LACT

• ilya-zlobintsev LACT
• CWE-61

Runtipi: Authenticated arbitrary file write via backup restore symlink planting

• runtipi
• Path traversal
• CWE-61

Incus vulnerable to root RCE via image backup.yaml symlink

• lxc incus
• Path traversal
• CWE-61

Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature

• nix
• Race condition
• CWE-61

Filesystem sandbox escape when paths or symlinks contain trailing slashes

• CWE-61

>=0.0.0-0, <24.0.13 || >=25.0.0, <36.0.14 || >=37.0.0, <46.0.3 || >=47.0.0, <47.0.4 · fixed in 24.0.13, 36.0.14, 46.0.3, 47.0.4

Dell AppSync: Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1…

• Dell AppSync
• Dell Metro Node
• CWE-61

crun follows rootfs /dev symlink while creating default devices

• containers crun
• CWE-61

rsync < 3.5.0 Arbitrary File Read via Symlink Following

• rsync
• CWE-61

Smarty: Symlink path traversal out of trusted directories

• Path traversal
• CWE-61

<4.5.7 || >=5.0.0, <5.8.2 · fixed in 4.5.7, 5.8.2

`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

• CWE-61

<5.1.5 · fixed in 5.1.5

skilo add follows symbolic links, allowing arbitrary local file disclosure from a malicious skill source

• Path traversal
• CWE-61

>=0.5.0, <0.11.1 · fixed in 0.11.1

Authenticated RCE via Symlink Following in Cribl Stream Pack Git Import

• Cribl Stream
• CWE-61

perwendel spark SparkJava ExternalResourceHandler.jav staticFiles.externalLocation symlink

• perwendel spark
• Path traversal
• CWE-61

Datasets Symlink-following Arbitrary File Write via Extractor.extract()

• huggingface datasets
• CWE-61

Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys

• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 10
• CWE-61

LPE from suricata user to root due to chown in %post in suricata packaging

• openSUSE Tumbleweed
• CWE-61

Root escape via symlink plus trailing slash in os

• CWE-61

<1.25.12 || >=1.26.0-0, <1.26.5 || >=1.27.0-0, <1.27.0-rc.2 · fixed in 1.25.12, 1.26.5, 1.27.0-rc.2

zcaceres markdownify-mcp Markdownify.ts assertPathAllowed symlink

• zcaceres markdownify-mcp
• Path traversal
• CWE-61

Snowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path Restriction

• Snowflake CLI
• Path traversal
• CWE-61

Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit

• Information disclosure
• CWE-61

<1.9.2 · fixed in 1.9.2

Cargo crates in third party registries can override the cached source of other crates

• CWE-61

<0.97.0 · fixed in 0.97.0

extract-zip unvalidated symlink path traversal

• Path traversal
• CWE-61

<=2.0.1 · no fixed version yet

KubeVirt virt-handler network cache symlink vulnerability allows arbitrary host file overwrite

• CWE-61

<=1.10.0-rc.0 · no fixed version yet

Kubevirt: virt-handler-rhel9: kubevirt: safepath symlink following in virt-handler enables notify socket hijacking and node-level vm disruption

• Red Hat Container Native Virtualization 4.12
• Red Hat Container Native Virtualization 4.13
• CWE-61

OpenTofu: Provider cache installation follows root-module-controlled package directory symlink and writes outside the working tree

• Path traversal
• CWE-61

<1.10.10 || >=1.11.0, <1.11.7 · fixed in 1.10.10, 1.11.7

Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym

• Path traversal
• CWE-61

<0.14.3 · fixed in 0.14.3

rasta-mouse pwnlift: pwnlift before d7a9544, in a privileged deployment…

• rasta-mouse pwnlift
• CWE-61

runc: Malicious image with /dev symlink can trigger limited host filesystem integrity violations

• CWE-61

<1.3.6 || >=1.4.0, <1.4.3 || >=1.5.0-rc.1, <1.5.0-rc.3 · fixed in 1.3.6, 1.4.3, 1.5.0-rc.3

ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer

• Path traversal
• Race condition

<1.2.14 · fixed in 1.2.14