目标达成 感谢每一位支持者 — 我们达成了 100% 目标!

目标: 1000 元 · 已筹: 1359 元

100%

CWE-59 在文件访问前对链接解析不恰当(链接跟随) 类漏洞列表 641

CWE-59 在文件访问前对链接解析不恰当(链接跟随) 类弱点 641 条 CVE 漏洞汇总,含 AI 中文分析。

CWE-59 属于文件访问类漏洞,指程序在访问文件前未正确验证链接解析结果。攻击者常通过创建指向敏感资源的符号链接或快捷方式,诱导程序读取非预期文件,从而引发信息泄露或权限提升。开发者应避免直接使用用户输入的文件名,需在访问前校验最终解析路径,确保其位于预期的安全目录内,防止链接劫持风险。

MITRE CWE 官方描述
CWE:CWE-59 文件访问前链接解析不当('Link Following') 英文:产品尝试基于文件名访问文件,但未能正确防止该文件名标识解析到非预期资源的链接或快捷方式。
常见影响 (2)
Confidentiality, Integrity, Access Control Read Files or Directories, Modify Files or Directories, Bypass Protection Mechanism
An attacker may be able to traverse the file system to unintended locations and read or overwrite the contents of unexpected files. If the files are used for a security mechanism then an attacker may be able to bypass the mechanism.
Other Execute Unauthorized Code or Commands
Windows simple shortcuts, sometimes referred to as soft links, can be exploited remotely since a ".LNK" file can be uploaded like a normal file. This can enable remote execution.
缓解措施 (1)
Architecture and Design Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
CVE ID 标题 CVSS 风险等级 Published
CVE-2026-81690 Tobi OpenSSL Encrypt 后置链接漏洞 — openssl_encrypt 7.3 High 2026-08-27
CVE-2026-56651 Scott Baker Dool 后置链接漏洞 — dool 2.0 Low 2026-08-27
CVE-2026-81572 WIBU-SYSTEMS CodeMeter Runtime 后置链接漏洞 — codemeter-runtime 7.8 High 2026-08-27
CVE-2026-65647 WebPros Plesk Migrator 后置链接漏洞 — Plesk Migrator 8.7 High 2026-08-26
CVE-2026-66153 SonicWALL NetExtender 后置链接漏洞 — NetExtender - - 2026-08-25
CVE-2026-79655 sosreport SoS 后置链接漏洞 — Red Hat Enterprise Linux 10 7.8 High 2026-08-25
CVE-2026-72696 Grav 后置链接漏洞 — grav 8.4 High 2026-08-25
CVE-2026-76845 The Brain ADM-ZIP 后置链接漏洞 — adm-zip 6.5 Medium 2026-08-24
CVE-2026-70626 NLTK 后置链接漏洞 — nltk 6.2 Medium 2026-08-22
CVE-2026-55168 Runtipi 后置链接漏洞 — runtipi 6.5 Medium 2026-08-21
CVE-2026-77815 zanllp Infinite Image Browsing 后置链接漏洞 — infinite-image-browsing 7.5 High 2026-08-21
CVE-2026-63125 LXC Incus 后置链接漏洞 — incus 9.9 Critical 2026-08-21
CVE-2026-17171 IBM AIX 后置链接漏洞 — AIX 7.8 High 2026-08-20
CVE-2026-16989 IBM AIX 后置链接漏洞 — AIX 7.1 High 2026-08-20
CVE-2026-16980 IBM AIX 后置链接漏洞 — AIX 6.3 Medium 2026-08-20
CVE-2026-18267 Kenwood DNR1007XR 后置链接漏洞 — DNR1007XR - - 2026-08-20
CVE-2026-55086 ETHER etherpad 资源管理错误漏洞 — etherpad 4.2 Medium 2026-08-19
CVE-2026-56796 Dell Command Update 后置链接漏洞 — Dell Command Update (DCU) 6.6 Medium 2026-08-19
CVE-2026-47187 libfuse sshfs 后置链接漏洞 — sshfs 9.3 Critical 2026-08-19
CVE-2026-76037 Google Chrome 后置链接漏洞 — Chrome - - 2026-08-18
CVE-2026-17106 Moby go-archive 后置链接漏洞 — go-archive 7.1 High 2026-08-18
CVE-2026-19693 Max extract-zip 路径遍历漏洞 — extract-zip 8.1 High 2026-08-17
CVE-2026-74796 opentofu 后置链接漏洞 — opentofu 6.1 Medium 2026-08-16
CVE-2026-19909 PAX Technology Q80 后置链接漏洞 — Q80 - - 2026-08-14
CVE-2026-15994 Lenovo Vantage 后置链接漏洞 — Commercial Vantage 7.0 High 2026-08-13
CVE-2026-63426 Lenovo Dock Manager 后置链接漏洞 — Dock Manager 7.1 High 2026-08-13
CVE-2026-12036 Lenovo Vantage 后置链接漏洞 — Vantage 7.1 High 2026-08-13
CVE-2026-53801 RsyncProject Rsync 竞争条件问题漏洞 — rsync 5.9 Medium 2026-08-13
CVE-2026-53800 RsyncProject Rsync 竞争条件问题漏洞 — rsync 4.7 Medium 2026-08-13
CVE-2026-53799 RsyncProject Rsync 竞争条件问题漏洞 — rsync 6.3 Medium 2026-08-13

CWE-59(在文件访问前对链接解析不恰当(链接跟随)) 是常见的弱点类别,本平台收录该类弱点关联的 641 条 CVE 漏洞。