Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
`afero.NewBasePathFs` confines basic file operations but does not natively prevent symlink escapes. If an attacker can create or manipulate symlinks within this filesystem, they may execute a symlink attack to read or overwrite files outside the intended base path. Manual check-before-act validations often introduce Time-of-Check-to-Time-of-Use (TOCTOU) vuln
Archive extraction without resolving symlinks in the destination parent directories can lead to chained symlink traversal (Tar Slip) vulnerabilities. By placing a directory symlink in the archive and modifying content through it, an attacker can escape the target directory constraint even if standard path validations are performed. Call `filepath.EvalSymlink
Checking whether a path is a directory and conditionally deleting it using unanchored deletion methods (`shutil.rmtree`, `.unlink()`, `os.remove`) creates a Time-of-Check Time-of-Use (TOCTOU) race condition. If an attacker swaps a parent directory with a symlink between the check and the deletion call, arbitrary files and directories outside the intended bou
A Livewire form containing a password input uses the `wire:submit` directive without the `.prevent` modifier. In older versions of Livewire, this omission causes the browser to perform a native HTML GET submission by default. This causes sensitive credentials (like user passwords) to leak directly into the URL query string, where they can be cached in browse
A symlink target is constructed and validated against an extraction base path instead of the symlink's actual parent directory. This writes absolute or structurally vulnerable relative paths directly into the symlink, leading to path traversal bypasses when traversed by the OS. Derive the safe execution target using `lexically_relative(symlink.parent_path())
A custom tarfile extraction sequence iterates over members but fails to validate symbolic links using `.issym()` or `.islnk()`. While this loop may attempt to prevent directory traversal (e.g., mitigating CVE-2007-4559), missing symlink checks can lead to arbitrary file overwrite. Attackers can exploit this by crafting archives with symlinks pointing outside
Dynamically constructing a file path and opening it with `File::create` can lead to path traversal and symlink vulnerabilities if the input is unvalidated. `File::create` implicitly follows symbolic links. Validate path components to ensure they do not contain directory traversal characters (e.g., `../`), and prefer using `OpenOptions` with `custom_flags(lib
Extracting archives without checking for symbolic links can lead to arbitrary file write (symlink escape). An attacker can craft an archive with a symbolic link pointing outside the extraction directory, followed by a file that writes through the symlink. Ensure all entries are validated for symlinks before extraction.
Catching a generic `IOException` or `Exception` when calling `toRealPath()` and falling back to `normalize()` can mask symlink validation errors (e.g., AccessDeniedException). If `toRealPath()` fails due to an access exception on a symlink, the fallback path will circumvent symlink resolution, leading to directory traversal vulnerabilities. Catch `NoSuchFile
Appending an absolute path directly to a tarball archive can leak local directory structures or cause arbitrary file overwrites when extracted. Ensure paths are relative by stripping root prefixes before archiving.
A path returned by a `sanitizePath`-style helper (lexical-only cleaning that does not resolve symlinks) flows into a symlink-following stdlib filesystem call (os.WriteFile / os.MkdirAll / os.Symlink / os.Link / os.OpenFile / etc.). A pre-existing or attacker-planted symlink under the base directory can redirect the resulting kernel pathname resolution outsid
A custom tar archive extraction loop iterates over members to filter paths but fails to properly check for symlinks or hardlinks. Relying solely on path traversal checks does not prevent Symlink Escape attacks (a variant of Zip Slip), where an archive contains a symlink targeting outside the extraction directory and writes files through it. Ensure that `issy
Tarfile extraction iterates over archive members (often to mitigate CVE-2007-4559) but fails to validate symlinks using `issym()`, `islnk()`, `linkname`, or `type`. This allows symlink escape attacks where a malicious archive creates symlinks pointing outside the extraction directory.
FileDir::makeCorrectDir() is called on a path built by concatenating a customer's documentroot with user-supplied data (DataDump export path), but without the second $fixed_homedir argument. Without that argument the symlink-escape validation in FileDir::makeCorrectDir() (lines 134-157) is skipped entirely, so a customer-owned symlink inside their home direc
An extraction loop over `tarfile` members was detected without explicit validation for symbolic or hard links. Attackers can embed a symbolic link in an archive that points outside the destination directory, bypassing normal path traversal validations, to achieve arbitrary file writes (Symlink Escape). Ensure `member.issym()` and `member.islnk()` are checked
Magic login link containing an authentication token is returned to the caller after being delivered by email. If the caller exposes this return value through an HTTP response, an unauthenticated attacker who knows a target email can retrieve the login token directly (CVE-2026-39912). Return only a boolean success indicator instead of the link.
Extracting tar archives without validating member symlinks allows symlink escape attacks. Path prefix validation on members often evaluates raw strings prior to extraction, failing to account for symlinks created dynamically on disk during the extraction process. Validate archive members by checking `issym()`, `islnk()`, and resolving `linkname` to ensure ex
Dynamically constructed paths passed to `File::create` can lead to path traversal and symlink attack vulnerabilities if the variables contain untrusted input. `File::create` inherently follows symlinks and truncates files. Validate the input using a strict allowlist of characters and consider using `OpenOptions` with `libc::O_NOFOLLOW` instead of `File::crea
flatpak_run_app() is defined without GArray *bind_fds / GArray *ro_bind_fds parameters. Without them, the Flatpak portal must forward sandbox-expose paths as raw path strings to bubblewrap --bind, which follows symlinks at mount time. A sandboxed app can plant a symlink inside its writable instance directory pointing to any host path and supply it as a sandb
Archive extraction via `tarfile.extractall` iterates over members and attempts safety validation but misses symlink target validation. This allows a bypass via malicious symbolic links pointing outside the extraction directory. Verify all members using `issym()` and `islnk()`.
Missing scoped path resolution when joining strings for file access. Immediately opening a joined path without validating its final resolved location against the intended root directory can permit attackers to read arbitrary files via path traversal or malicious symbolic links. Ensure the resulting path is securely validated before being opened.
Insufficient lexical boundary check allows directory traversal via symbolic links. Checking paths using only `os.path.isabs` and substring checks for `..` fails to prevent symlink-based boundary escapes. Use `Path.resolve()` to resolve links and enforce scoped sandbox constraints.
Lexical path checks without resolution permit path traversal via symbolic links. An attacker can embed a symlink in a corpus archive pointing out of bounds, bypassing sandbox checks and reading arbitrary files. Use resolved paths and verify they strictly reside under the intended root.
Using `fs::metadata()` instead of `fs::symlink_metadata()` to inspect a path following a directory creation error allows attackers to bypass boundary checks using symlinks. `fs::metadata()` follows symbolic links, meaning if an attacker creates a symlink where a directory is expected, the application will evaluate the target of the symlink. Use `fs::symlink_
