CWE-59
AllowedImproper Link Resolution Before File Access ('Link Following')
Abstraction: Base · Status: Draft
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
2320 vulnerabilities reference this CWE, most recent first.
GHSA-VGR5-M78W-8RC3
Vulnerability from github – Published: 2022-05-17 03:47 – Updated: 2022-05-17 03:47The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on the pid file created for (1) svnwcsub.py or (2) irkerbridge.py when the --pidfile option is used. NOTE: this issue was SPLIT from CVE-2013-4262 based on different affected versions (ADT3).
{
"affected": [],
"aliases": [
"CVE-2013-7393"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2014-07-28T19:55:00Z",
"severity": "LOW"
},
"details": "The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on the pid file created for (1) svnwcsub.py or (2) irkerbridge.py when the --pidfile option is used. NOTE: this issue was SPLIT from CVE-2013-4262 based on different affected versions (ADT3).",
"id": "GHSA-vgr5-m78w-8rc3",
"modified": "2022-05-17T03:47:56Z",
"published": "2022-05-17T03:47:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7393"
},
{
"type": "WEB",
"url": "https://subversion.apache.org/security/CVE-2013-4262-advisory.txt"
},
{
"type": "WEB",
"url": "http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-VH52-RW4G-55J6
Vulnerability from github – Published: 2025-06-02 06:30 – Updated: 2025-06-02 06:30Bluetooth HCI Adaptor from Realtek has a Link Following vulnerability. Local attackers with regular privileges can create a symbolic link with the same name as a specific file, causing the product to delete arbitrary files pointed to by the link. Subsequently, attackers can leverage arbitrary file deletion to privilege escalation.
{
"affected": [],
"aliases": [
"CVE-2024-11857"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-02T04:15:26Z",
"severity": "HIGH"
},
"details": "Bluetooth HCI Adaptor from Realtek has a Link Following vulnerability. Local attackers with regular privileges can create a symbolic link with the same name as a specific file, causing the product to delete arbitrary files pointed to by the link. Subsequently, attackers can leverage arbitrary file deletion to privilege escalation.",
"id": "GHSA-vh52-rw4g-55j6",
"modified": "2025-06-02T06:30:32Z",
"published": "2025-06-02T06:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11857"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/en/cp-139-10161-fa1b5-2.html"
},
{
"type": "WEB",
"url": "https://www.twcert.org.tw/tw/cp-132-10160-76012-1.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-VJ44-3F5X-MRMP
Vulnerability from github – Published: 2022-01-11 00:01 – Updated: 2022-01-15 00:03A link following denial-of-service vulnerability in Trend Micro Worry-Free Business Security (on prem only) could allow a local attacker to overwrite arbitrary files in the context of SYSTEM. This is similar to, but not the same as CVE-2021-44024. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2021-45442"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-10T14:10:00Z",
"severity": "HIGH"
},
"details": "A link following denial-of-service vulnerability in Trend Micro Worry-Free Business Security (on prem only) could allow a local attacker to overwrite arbitrary files in the context of SYSTEM. This is similar to, but not the same as CVE-2021-44024. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"id": "GHSA-vj44-3f5x-mrmp",
"modified": "2022-01-15T00:03:29Z",
"published": "2022-01-11T00:01:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45442"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/solution/000289996"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-22-015"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-VJCJ-64VH-89F7
Vulnerability from github – Published: 2022-05-13 01:03 – Updated: 2022-05-13 01:03In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files.
{
"affected": [],
"aliases": [
"CVE-2017-16611"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-12-01T17:29:00Z",
"severity": "MODERATE"
},
"details": "In libXfont before 1.5.4 and libXfont2 before 2.0.3, a local attacker can open (but not read) files on the system as root, triggering tape rewinds, watchdogs, or similar mechanisms that can be triggered by opening files.",
"id": "GHSA-vjcj-64vh-89f7",
"modified": "2022-05-13T01:03:32Z",
"published": "2022-05-13T01:03:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-16611"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1050459"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/01/msg00028.html"
},
{
"type": "WEB",
"url": "https://marc.info/?l=freedesktop-xorg-announce\u0026m=151188044218304\u0026w=2"
},
{
"type": "WEB",
"url": "https://marc.info/?l=freedesktop-xorg-announce\u0026m=151188049718337\u0026w=2"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201801-10"
},
{
"type": "WEB",
"url": "http://security.cucumberlinux.com/security/details.php?id=155"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2017/11/28/7"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-3500-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VJJH-7673-9X6Q
Vulnerability from github – Published: 2022-05-02 00:00 – Updated: 2022-05-02 00:00Race condition in the jas_stream_tmpfile function in libjasper/base/jas_stream.c in JasPer 1.900.1 allows local users to cause a denial of service (program exit) by creating the appropriate tmp.XXXXXXXXXX temporary file, which causes Jasper to exit. NOTE: this was originally reported as a symlink issue, but this was incorrect. NOTE: some vendors dispute the severity of this issue, but it satisfies CVE's requirements for inclusion.
{
"affected": [],
"aliases": [
"CVE-2008-3521"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2008-10-02T18:18:00Z",
"severity": "HIGH"
},
"details": "Race condition in the jas_stream_tmpfile function in libjasper/base/jas_stream.c in JasPer 1.900.1 allows local users to cause a denial of service (program exit) by creating the appropriate tmp.XXXXXXXXXX temporary file, which causes Jasper to exit. NOTE: this was originally reported as a symlink issue, but this was incorrect. NOTE: some vendors dispute the severity of this issue, but it satisfies CVE\u0027s requirements for inclusion.",
"id": "GHSA-vjjh-7673-9x6q",
"modified": "2022-05-02T00:00:57Z",
"published": "2022-05-02T00:00:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2008-3521"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-3521"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45622"
},
{
"type": "WEB",
"url": "http://bugs.gentoo.org/attachment.cgi?id=163282\u0026action=view"
},
{
"type": "WEB",
"url": "http://bugs.gentoo.org/show_bug.cgi?id=222819"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/34391"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:142"
},
{
"type": "WEB",
"url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:164"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/31470"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-742-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-VM56-HJ47-795X
Vulnerability from github – Published: 2022-05-24 17:41 – Updated: 2022-05-24 17:41autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location.
{
"affected": [],
"aliases": [
"CVE-2020-36241"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-02-05T14:15:00Z",
"severity": "MODERATE"
},
"details": "autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file\u0027s parent is a symlink to a directory outside of the intended extraction location.",
"id": "GHSA-vm56-hj47-795x",
"modified": "2022-05-24T17:41:11Z",
"published": "2022-05-24T17:41:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36241"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/gnome-autoar/-/commit/adb067e645732fdbe7103516e506d09eb6a54429"
},
{
"type": "WEB",
"url": "https://gitlab.gnome.org/GNOME/gnome-autoar/-/issues/7"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BN5TVQ7OHZEGY6AGFLAZWCVCI53RYNHQ"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202105-10"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-VM84-HXMH-36RV
Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2022-05-24 19:20In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions.
{
"affected": [],
"aliases": [
"CVE-2021-41057"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-14T21:15:00Z",
"severity": "HIGH"
},
"details": "In WIBU CodeMeter Runtime before 7.30a, creating a crafted CmDongles symbolic link will overwrite the linked file without checking permissions.",
"id": "GHSA-vm84-hxmh-36rv",
"modified": "2022-05-24T19:20:39Z",
"published": "2022-05-24T19:20:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-41057"
},
{
"type": "WEB",
"url": "https://cdn.wibu.com/fileadmin/wibu_downloads/security_advisories/Advisory_WIBU-210910-01.pdf"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-580693.pdf"
},
{
"type": "WEB",
"url": "https://www.wibu.com/us/support/security-advisories.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-VP3H-GHGH-JR7G
Vulnerability from github – Published: 2026-08-06 20:10 – Updated: 2026-08-06 20:10Summary
The Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious — or on-path (MITM) — remote cache server can return a crafted tar archive whose entries escape the cache directory and write to arbitrary locations on the machine running Nx. This arbitrary file write can be escalated to remote code execution. The directly exploitable issue is the self-hosted HTTP remote cache.
Affected Packages
[!IMPORTANT] Nx's default local cache and Nx Cloud are NOT affected. The default local cache and Nx Cloud use separate cache retrieval and extraction mechanisms that does not have this vulnerability. Only workspaces that use a self-hosted remote cache (
NX_SELF_HOSTED_REMOTE_CACHE_SERVER,@nx/s3-cache, etc.) are affected.
Two self-hosted cache surfaces are affected:
- The built-in HTTP remote cache (
NX_SELF_HOSTED_REMOTE_CACHE_SERVER, innx) — fixed in the patched release. - The self-hosted cache packages —
@nx/s3-cache,@nx/gcs-cache,@nx/azure-cache,@nx/shared-fs-cache(and their@nx/powerpack-*predecessors) — the same flaw in their own extractor. Deprecated (CVE-2025-36852) and not patched; migrate off (see Remediation).
The shared step that copies cached outputs into the workspace was also part of the exposure and is hardened in the patched nx release.
Remediation
Upgrade to Nx 22.7.7 or 23.0.2 (or later). The patched extractor is a drop-in — no configuration change is required.
If you use the S3, GCS, Azure, or shared-filesystem cache packages
@nx/s3-cache, @nx/gcs-cache, @nx/azure-cache, and @nx/shared-fs-cache (and their @nx/powerpack-* predecessors) are separately versioned packages and are already deprecated (see CVE-2025-36852). Upgrading nx hardens the shared restore step, but it does not fully secure these packages. The remediation for them is to migrate off — to Nx Cloud or the self-hosted OpenAPI/HTTP remote cache — per the deprecation guidance: https://nx.dev/docs/reference/deprecated/self-hosted-cache-packages
Details
When Nx retrieves an artifact from the self-hosted HTTP remote cache, it downloads a gzipped tar archive and extracts it. The extractor joined each untrusted tar entry name directly onto the output directory and unpacked it with tar's unguarded Entry::unpack(), which performs no containment check:
// vulnerable
let path_on_disk = output_dir.join(entry_path); // entry_path is attacker-controlled
fs::create_dir_all(path_on_disk.parent()…)?;
entry.unpack(&path_on_disk)?;
In addition, restore now copies only the declared task outputs (never the whole cache directory), confined to the workspace root; parent directories are realized as real directories so a write can never traverse a symlink; declared outputs that resolve outside the workspace are rejected; and the malformed-input cases return errors instead of panicking.
References
- Fix: https://github.com/nrwl/nx/pull/36116 (merged)
- TLS-verification warning follow-up: https://github.com/nrwl/nx/pull/36132 (merged)
- Vulnerable extractor introduced in Nx 20.8.0: https://github.com/nrwl/nx/pull/30593
Credits
- Lidor B., Novee Security — Reporter
- Assaf Levkovich, Novee Security — Reporter
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "nx"
},
"ranges": [
{
"events": [
{
"introduced": "20.8.0"
},
{
"fixed": "22.7.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@nx/s3-cache"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.0.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@nx/gcs-cache"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.0.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@nx/azure-cache"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.0.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@nx/shared-fs-cache"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.0.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@nx/powerpack-s3-cache"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.0.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@nx/powerpack-gcs-cache"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.0.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@nx/powerpack-azure-cache"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.0.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "@nx/powerpack-shared-fs-cache"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "5.0.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "npm",
"name": "nx"
},
"ranges": [
{
"events": [
{
"introduced": "23.0.0"
},
{
"fixed": "23.0.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-71476"
],
"database_specific": {
"cwe_ids": [
"CWE-22",
"CWE-59"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-06T20:10:03Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\n\nThe Nx **self-hosted HTTP remote cache** extracts downloaded cache artifacts without constraining where files are written. A malicious \u2014 or on-path (MITM) \u2014 remote cache server can return a crafted tar archive whose entries escape the cache directory and write to arbitrary locations on the machine running Nx. This arbitrary file write can be escalated to remote code execution. The directly exploitable issue is the self-hosted HTTP remote cache.\n\n## Affected Packages\n\n\u003e [!IMPORTANT]\n\u003e **Nx\u0027s default local cache and Nx Cloud are NOT affected.** The default local cache and Nx Cloud use separate cache retrieval and extraction mechanisms that does not have this vulnerability. Only workspaces that use a self-hosted remote cache (`NX_SELF_HOSTED_REMOTE_CACHE_SERVER`, `@nx/s3-cache`, etc.) are affected.\n\nTwo self-hosted cache surfaces are affected:\n\n1. **The built-in HTTP remote cache** (`NX_SELF_HOSTED_REMOTE_CACHE_SERVER`, in `nx`) \u2014 **fixed** in the patched release.\n2. **The self-hosted cache packages** \u2014 `@nx/s3-cache`, `@nx/gcs-cache`, `@nx/azure-cache`, `@nx/shared-fs-cache` (and their `@nx/powerpack-*` predecessors) \u2014 the same flaw in their own extractor. **Deprecated** (CVE-2025-36852) and not patched; migrate off (see Remediation).\n\nThe shared step that copies cached outputs into the workspace was also part of the exposure and is hardened in the patched `nx` release.\n\n## Remediation\n\n**Upgrade to Nx `22.7.7` or `23.0.2` (or later).** The patched extractor is a drop-in \u2014 no configuration change is required.\n\n### If you use the S3, GCS, Azure, or shared-filesystem cache packages\n\n`@nx/s3-cache`, `@nx/gcs-cache`, `@nx/azure-cache`, and `@nx/shared-fs-cache` (and their `@nx/powerpack-*` predecessors) are separately versioned packages and are **already deprecated** (see CVE-2025-36852). Upgrading `nx` hardens the shared restore step, but it does not fully secure these packages. The remediation for them is to **migrate off** \u2014 to Nx Cloud or the self-hosted OpenAPI/HTTP remote cache \u2014 per the deprecation guidance: https://nx.dev/docs/reference/deprecated/self-hosted-cache-packages\n\n## Details\n\nWhen Nx retrieves an artifact from the self-hosted HTTP remote cache, it downloads a gzipped tar archive and extracts it. The extractor joined each untrusted tar entry name directly onto the output directory and unpacked it with `tar`\u0027s **unguarded** `Entry::unpack()`, which performs no containment check:\n\n```rust\n// vulnerable\nlet path_on_disk = output_dir.join(entry_path); // entry_path is attacker-controlled\nfs::create_dir_all(path_on_disk.parent()\u2026)?;\nentry.unpack(\u0026path_on_disk)?;\n```\n\nIn addition, restore now copies **only** the declared task outputs (never the whole cache directory), confined to the workspace root; parent directories are realized as real directories so a write can never traverse a symlink; declared outputs that resolve outside the workspace are rejected; and the malformed-input cases return errors instead of panicking.\n\n## References\n\n- Fix: https://github.com/nrwl/nx/pull/36116 (merged)\n- TLS-verification warning follow-up: https://github.com/nrwl/nx/pull/36132 (merged)\n- Vulnerable extractor introduced in Nx 20.8.0: https://github.com/nrwl/nx/pull/30593\n\n## Credits\n\n- **Lidor B.**, Novee Security \u2014 Reporter\n- **Assaf Levkovich**, Novee Security \u2014 Reporter",
"id": "GHSA-vp3h-ghgh-jr7g",
"modified": "2026-08-06T20:10:03Z",
"published": "2026-08-06T20:10:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nrwl/nx/security/advisories/GHSA-vp3h-ghgh-jr7g"
},
{
"type": "WEB",
"url": "https://github.com/nrwl/nx/pull/36116"
},
{
"type": "WEB",
"url": "https://github.com/nrwl/nx/commit/2b20c2da39d263c32ae05767577589481a309fee"
},
{
"type": "WEB",
"url": "https://github.com/nrwl/nx/commit/a82807621e4176e37909d2c1afede661b45cc30"
},
{
"type": "WEB",
"url": "https://github.com/nrwl/nx/commit/ad296578fe980a4aad66f8af0add21f6ddf907d9"
},
{
"type": "PACKAGE",
"url": "https://github.com/nrwl/nx"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Nx: Zip-Slip in the self-hosted remote cache"
}
GHSA-VPFC-9392-2W4Q
Vulnerability from github – Published: 2023-05-31 00:31 – Updated: 2023-11-25 12:30Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a local attacker to perform privilege escalation via crafted symbolic link. (Chromium security severity: Medium)
{
"affected": [],
"aliases": [
"CVE-2023-2939"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-30T22:15:10Z",
"severity": "HIGH"
},
"details": "Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a local attacker to perform privilege escalation via crafted symbolic link. (Chromium security severity: Medium)",
"id": "GHSA-vpfc-9392-2w4q",
"modified": "2023-11-25T12:30:22Z",
"published": "2023-05-31T00:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-2939"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2023/05/stable-channel-update-for-desktop_30.html"
},
{
"type": "WEB",
"url": "https://crbug.com/1427431"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202311-11"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202401-34"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2023/dsa-5418"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-VPGM-2FHH-PJFQ
Vulnerability from github – Published: 2025-06-17 21:32 – Updated: 2025-06-17 21:32A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations.
Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
{
"affected": [],
"aliases": [
"CVE-2025-30640"
],
"database_specific": {
"cwe_ids": [
"CWE-59"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-17T21:15:37Z",
"severity": "HIGH"
},
"details": "A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations.\n\nPlease note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.",
"id": "GHSA-vpgm-2fhh-pjfq",
"modified": "2025-06-17T21:32:30Z",
"published": "2025-06-17T21:32:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30640"
},
{
"type": "WEB",
"url": "https://success.trendmicro.com/en-US/solution/KA-0019344"
},
{
"type": "WEB",
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-239"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-48.1
Strategy: Separation of Privilege
- Follow the principle of least privilege when assigning access rights to entities in a software system.
- Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CAPEC-132: Symlink Attack
An adversary positions a symbolic link in such a manner that the targeted user or application accesses the link's endpoint, assuming that it is accessing a file with the link's name.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.