目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CWE-59 在文件访问前对链接解析不恰当(链接跟随) 类漏洞列表 641

CWE-59 在文件访问前对链接解析不恰当(链接跟随) 类弱点 641 条 CVE 漏洞汇总，含 AI 中文分析。

CWE-59 属于文件访问类漏洞，指程序在访问文件前未正确验证链接解析结果。攻击者常通过创建指向敏感资源的符号链接或快捷方式，诱导程序读取非预期文件，从而引发信息泄露或权限提升。开发者应避免直接使用用户输入的文件名，需在访问前校验最终解析路径，确保其位于预期的安全目录内，防止链接劫持风险。

MITRE CWE 官方描述
CWE：CWE-59 文件访问前链接解析不当（'Link Following'） 英文：产品尝试基于文件名访问文件，但未能正确防止该文件名标识解析到非预期资源的链接或快捷方式。
常见影响 (2)
Confidentiality, Integrity, Access Control Read Files or Directories, Modify Files or Directories, Bypass Protection Mechanism
An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism then an attacker may be able to bypass the mechanism.
Other Execute Unauthorized Code or Commands
Windows simple shortcuts, sometimes referred to as soft links, can be exploited remotely since a ".LNK" file can be uploaded like a normal file. This can enable remote execution.
缓解措施 (1)
Architecture and Design Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-24047 Backstage 安全漏洞 — backstage 6.3 Medium 2026-01-21
CVE-2025-13154 Lenovo Vantage 安全漏洞 — Vantage 5.5 Medium 2026-01-14
CVE-2026-20941 Microsoft Windows 后置链接漏洞 — Windows 11 Version 24H2 7.8 High 2026-01-13
CVE-2026-22702 virtualenv 竞争条件问题漏洞 — virtualenv 4.5 Medium 2026-01-10
CVE-2026-22701 filelock 安全漏洞 — filelock 5.3 Medium 2026-01-10
CVE-2025-12838 MSP360 Free Backup 后置链接漏洞 — Free Backup 7.3AI High AI 2025-12-23
CVE-2023-53973 Zillya Total Security 安全漏洞 — Zillya Total Security 8.4 High 2025-12-22
CVE-2025-7073 Bitdefender Total Security 后置链接漏洞 — Total Security 7.8AI High AI 2025-12-10
CVE-2025-46636 Dell Encryption 后置链接漏洞 — Dell Encryption 6.6 Medium 2025-12-09
CVE-2025-46637 Dell Encryption 后置链接漏洞 — Dell Encryption 7.3 High 2025-12-09
CVE-2025-60710 Microsoft Windows 后置链接漏洞 — Windows 11 Version 24H2 7.8 High 2025-11-11
CVE-2025-59510 Microsoft Windows Routing and Remote Access Service 后置链接漏洞 — Windows 10 Version 1607 5.5 Medium 2025-11-11
CVE-2025-5718 AXIS OS 安全漏洞 — AXIS OS 6.8 Medium 2025-11-11
CVE-2025-11578 GitHub Enterprise Server 安全漏洞 — Enterprise Server 7.2 - 2025-11-10
CVE-2025-64437 Kubevirt 后置链接漏洞 — kubevirt 5.0 Medium 2025-11-07
CVE-2025-12418 Revenera InstallShield 安全漏洞 — InstallShield 4.4 - 2025-11-07
CVE-2025-9870 Razer Synapse 3 后置链接漏洞 — Synapse 3 7.8AI High AI 2025-10-29
CVE-2025-9871 Razer Synapse 3 后置链接漏洞 — Synapse 3 7.8AI High AI 2025-10-29
CVE-2025-9869 Razer Synapse 3 后置链接漏洞 — Synapse 3 7.8AI High AI 2025-10-29
CVE-2025-12341 AntiDupl 后置链接漏洞 — AntiDupl 7.8 High 2025-10-28
CVE-2025-26625 Git Lfs 后置链接漏洞 — git-lfs 8.1AI High AI 2025-10-17
CVE-2025-59241 Microsoft Windows 后置链接漏洞 — Windows 11 Version 24H2 7.8 High 2025-10-14
CVE-2025-59281 Microsoft Xbox Gaming Services 后置链接漏洞 — Xbox Gaming Services 7.8 High 2025-10-14
CVE-2025-55247 Microsoft .NET 后置链接漏洞 — .NET 8.0 7.3 High 2025-10-14
CVE-2025-62363 YtGrabber-TUI 后置链接漏洞 — YtGrabber-TUI 7.8 High 2025-10-13
CVE-2025-62364 Text Generation Web UI 后置链接漏洞 — text-generation-webui 6.2 Medium 2025-10-13
CVE-2025-9968 ASUS Armoury Crate 安全漏洞 — Armoury Crate 7.8AI High AI 2025-10-13
CVE-2025-11462 Amazon AWS VPN Client 安全漏洞 — Client VPN 7.8 High 2025-10-07
CVE-2025-41421 TeamViewer Full Client和TeamViewer Host 安全漏洞 — Full Client 4.7 Medium 2025-10-01
CVE-2025-34191 Vasion Print和Vasion Print Virtual Appliance Host 安全漏洞 — Print Virtual Appliance Host 7.1 - 2025-09-19

CWE-59（在文件访问前对链接解析不恰当(链接跟随)） 是常见的弱点类别，本平台收录该类弱点关联的 641 条 CVE 漏洞。