CWE-59: Improper Link Resolution Before File Access ('Link Following')

BaseDraftExploit Likelihood: Medium

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

View on MITRE
Back to CWE Lookup

Technical Details

Structure
Simple
Vulnerability Mapping
ALLOWED

Applicable To

Languages
Not Language-Specific
Platforms
WindowsUnix

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Combine analysis methods around the CWE-59 resource boundary

MITRE identifies automated static analysis, manual source review, dynamic analysis as applicable detection approaches. Use them to find privileged file operations that resolve attacker-influenced pathnames more than once or follow links outside a trusted directory, and prove checks apply to the same opened object that is ultimately used. Require a reproducible trace from attacker influence to the unsafe behavior, record coverage gaps, and confirm suspected findings dynamically where safe; no single technique establishes complete coverage.

CWE-59: detection methods and operational guidance — MITRE CWE

Resolve file links without opening a check-then-use race

Avoid making security decisions from an unchecked pathname when an attacker can substitute a hard or symbolic link. Prefer opening existing files with the requesting user's privileges or creating new files exclusively; use no-follow options where supported. When link inspection is unavoidable, compare the opened object with the inspected object and ensure the validation cannot race with the file operation.

POS01-C: Check for the existence of links when dealing with files — Carnegie Mellon SEI

Apply lessons from CVE-2025-48384 in Git

NVD maps CVE-2025-48384 to CWE-59; inconsistent handling of carriage returns in configuration paths enabled a link-following condition. Use the case to test canonicalization across parsers and operating systems, create adversarial repositories containing links and unusual control characters, and ensure checkout and configuration writes cannot escape the intended work tree.

CVE-2025-48384 Detail — NIST National Vulnerability Database

Eliminate file-system TOCTOU windows with CERT FIO45-C

Apply FIO45-C whenever code checks a pathname and later acts on it. Prefer a single atomic open or creation operation, operate through the returned file descriptor, and verify device and inode identity where multiple operations are unavoidable. Keep sensitive operations in trusted directories and document platform-specific link and mount semantics.

FIO45-C: Avoid TOCTOU race conditions while accessing files — Carnegie Mellon SEI

Test pathname resolution with openat2 constraints

Run privileged file operations inside an attacker-writable test tree while repeatedly replacing path components with symbolic links, mount points, and magic links. Verify RESOLVE_BENEATH, RESOLVE_NO_SYMLINKS, or equivalent platform controls reject escapes atomically. Cover creation, overwrite, delete, archive extraction, cleanup, upgrade, and error paths under concurrent link replacement.

openat2(2) Linux manual page — Linux man-pages project

Frequently Asked Questions

What is CWE-59: Improper Link Resolution Before File Access ('Link Following')?+

CWE-59: Improper Link Resolution Before File Access ('Link Following') is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

What are the security consequences of Improper Link Resolution Before File Access ('Link Following')?+

If exploited, CWE-59 (Improper Link Resolution Before File Access ('Link Following')) it can compromise Confidentiality, Integrity, Access Control and Other, leading to outcomes such as Read Files or Directories, Modify Files or Directories, Bypass Protection Mechanism and Execute Unauthorized Code or Commands.

How is Improper Link Resolution Before File Access ('Link Following') detected?+

CWE-59 can be detected using Automated Static Analysis - Binary or Bytecode, Manual Static Analysis - Binary or Bytecode, Dynamic Analysis with Automated Results Interpretation, Dynamic Analysis with Manual Results Interpretation, Manual Static Analysis - Source Code and Automated Static Analysis - Source Code. Combining automated tooling with manual review typically yields the best coverage.

Which programming languages are affected by Improper Link Resolution Before File Access ('Link Following')?+

CWE-59 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Improper Link Resolution Before File Access ('Link Following')?+

MITRE documents real CVEs mapped to CWE-59, including CVE-1999-1386, CVE-2000-1178, CVE-2004-0217, CVE-2003-0517 and CVE-2004-0689. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-59 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

Learn More

Find Related CVEs

Search for vulnerabilities that exploit CWE-59

CVE vs CWE: What's the Difference?

Understanding vulnerabilities vs weaknesses

Understanding CVSS Scoring

How vulnerability severity is measured

View Full MITRE Entry

Complete technical details and references

Advertisement