Security

What is Improper Link Resolution Before File (CWE-59)?

Improper Link Resolution Before File Access ('Link Following') (CWE-59) is a type of vulnerability that occurs when the product attempts to access a file...

SP
Shreya Pillai July 27, 2026 5 min read Security
AI-friendly summary

What it is: Improper Link Resolution Before File Access ('Link Following') (CWE-59) is a type of vulnerability that occurs when the product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Why it matters: Improper Link Resolution Before File Access ('Link Following') can lead to unauthorized access to sensitive files and directories, as well as bypassing protection mechanisms. This can result in confidentiality, integrity, and availability issues.

How to fix it: To fix Improper Link Resolution Before File Access ('Link Following'), follow the principle of least privilege, deny access to files that can be replaced with links to sensitive files, and ensure good compartmentalization in the system.

TL;DR: Improper Link Resolution Before File Access (‘Link Following’) (CWE-59) is a type of vulnerability that occurs when the product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. To fix this issue, follow the principle of least privilege and ensure good compartmentalization in the system.

At-a-Glance

Field Value
CWE ID CWE-59
OWASP Category A01:2025 - Broken Access Control
CAPEC CAPEC-132, CAPEC-17, CAPEC-35, CAPEC-76
Typical Severity Medium
Affected Technologies Java, C++, Python/Django, PHP
Detection Difficulty Moderate
Last Updated 2026-07-27

Improper Link Resolution Before File Access (‘Link Following’) (CWE-59) is a type of vulnerability that occurs when the product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. As defined by the MITRE Corporation under CWE-59, and classified by the OWASP Foundation under A01:2025 - Broken Access Control, this vulnerability can lead to unauthorized access to sensitive files and directories.

Quick Summary

Improper Link Resolution Before File Access (‘Link Following’) (CWE-59) is a type of vulnerability that occurs when the product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. This can result in confidentiality, integrity, and availability issues.

Jump to: What is Improper Link Resolution Before File Access (‘Link Following’)? · Quick Summary · Improper Link Resolution Before File Access (‘Link Following’) Overview · How Improper Link Resolution Before File Access (‘Link Following’) Works · Vulnerable Code · Secure Code · Business Impact of Improper Link Resolution Before File Access (‘Link Following’) · Improper Link Resolution Before File Access (‘Link Following’) Attack Scenario · How to Detect Improper Link Resolution Before File Access (‘Link Following’) · How to Fix Improper Link Resolution Before File Access (‘Link Following’) · Framework-Specific Fixes for Improper Link Resolution Before File Access (‘Link Following’) · How to Ask AI to Check Your Code for Improper Link Resolution Before File Access (‘Link Following’) · Improper Link Resolution Before File Access (‘Link Following’) Best Practices Checklist · Improper Link Resolution Before File Access (‘Link Following’) FAQ · Vulnerabilities Related to Improper Link Resolution Before File Access (‘Link Following’) · References · Scan Your Own Site

Improper Link Resolution Before File Access (‘Link Following’) (CWE-59) is a type of vulnerability that occurs when the product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

  • What: Improper Link Resolution Before File Access (‘Link Following’) (CWE-59) is a type of vulnerability that occurs when the product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
  • Why it matters: Improper Link Resolution Before File Access (‘Link Following’) can lead to unauthorized access to sensitive files and directories, as well as bypassing protection mechanisms. This can result in confidentiality, integrity, and availability issues.
  • Where it occurs: Improper Link Resolution Before File Access (‘Link Following’) can occur in various applications that handle file paths or filenames from external sources.
  • Who is affected: Any application that handles file paths or filenames from external sources can be affected by Improper Link Resolution Before File Access (‘Link Following’).
  • Who is NOT affected: Applications that never construct paths/queries/commands from external input are not affected.

Improper Link Resolution Before File Access (‘Link Following’) (CWE-59) occurs when the product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Root Cause

The root cause of Improper Link Resolution Before File Access (‘Link Following’) is accessing a file by name without checking whether that name resolves through a symbolic link — an attacker who can plant a symlink in a shared or predictable location (e.g. a world-writable temp directory) before the application runs can make the access land on a completely different, unintended file.

Attack Flow

  1. An attacker with write access to a shared/predictable directory the application uses (e.g. /tmp) creates a symlink at a filename the application is expected to write to, pointing at a sensitive target file (e.g. a system config file).
  2. The application opens/writes to that filename without checking whether it’s a symlink.
  3. The write follows the link and lands on the attacker’s chosen target instead of the intended file, corrupting or overwriting it with attacker-influenced content.

Prerequisites to Exploit

  • The application accesses a file in a directory writable by other, less-trusted users or processes.
  • The application opens the file by name without first checking (or atomically preventing) that name from resolving through a symlink.

Vulnerable Code

import os

def append_log(filename, entry):
    log_path = os.path.join('/tmp/app_logs', filename)
    with open(log_path, 'a') as f:
        f.write(entry)

filename names a file inside a shared, world-writable directory, and open() follows whatever that name resolves to at the moment of the call — including a symlink someone else planted there — with no check at all.

Secure Code

import os

def append_log(filename, entry):
    log_path = os.path.join('/tmp/app_logs', filename)
    fd = os.open(log_path, os.O_WRONLY | os.O_APPEND | os.O_CREAT | os.O_NOFOLLOW, 0o600)
    with os.fdopen(fd, 'a') as f:
        f.write(entry)

os.O_NOFOLLOW makes the open() call itself fail with ELOOP if the final path component is a symlink, closing the gap between checking and using the file that a separate “check then open” pattern would still leave open to a race.

Improper Link Resolution Before File Access (‘Link Following’) (CWE-59) can lead to unauthorized access to sensitive files and directories, as well as bypassing protection mechanisms. This can result in confidentiality, integrity, and availability issues.

  • Confidentiality: Improper Link Resolution Before File Access (‘Link Following’) can lead to unauthorized access to sensitive files and directories.
  • Integrity: Improper Link Resolution Before File Access (‘Link Following’) can lead to modification of sensitive files and directories.
  • Availability: Improper Link Resolution Before File Access (‘Link Following’) can lead to disruption of services.

Here is a step-by-step walkthrough of an attack scenario for Improper Link Resolution Before File Access (‘Link Following’):

  1. An attacker provides a malicious file path or filename to the application.
  2. The application attempts to access the file based on the provided filename without proper validation and sanitization.
  3. The application accesses the unintended resource, potentially leading to unauthorized access to sensitive files and directories.

Improper Link Resolution Before File Access (‘Link Following’) (CWE-59) can be detected through manual testing, automated scanners (SAST / DAST), and PenScan’s detection capabilities.

Manual Testing

  • Identify every file the application creates or opens by name inside a directory shared with other users or processes (temp directories, upload folders, shared cache paths).
  • For each one, pre-create a symlink at that exact filename pointing at a file you control, then trigger the application’s write/read and confirm whether it follows the link.
  • Check whether the open call uses a “check the file, then open it” pattern (a TOCTOU race) versus an atomic no-follow open.

Automated Scanners (SAST / DAST)

Static analysis can flag file operations on a path built from a name in a shared directory with no O_NOFOLLOW/no-follow flag nearby; dynamic testing is needed to actually plant a symlink and confirm the running application follows or rejects it, since the presence of a validation-looking function call doesn’t prove it’s race-free.

PenScan Detection

PenScan’s Nuclei and ZAP engines can probe for predictable shared-directory file paths, but confirming an actual symlink-follow requires filesystem-level access this pipeline doesn’t have — treat scanner findings here as a signal to manually verify with the test above.

False Positive Guidance

A finding on a file operation confined to a directory the application exclusively owns (not shared with other users/processes) is likely a false positive — the weakness requires another, less-trusted party to be able to plant the link before the access happens.

Improper Link Resolution Before File Access (‘Link Following’) (CWE-59) can be fixed by following the principle of least privilege and ensuring good compartmentalization in the system.

  • Follow the Principle of Least Privilege: Deny access to files that can be replaced with links to sensitive files.
  • Ensure Good Compartmentalization: Ensure that sensitive files and directories are stored in a secure location.

Improper Link Resolution Before File Access (‘Link Following’) (CWE-59) can be fixed using framework-specific fixes, such as:

  • Java: Use the java.io.File class to validate and sanitize file paths.
  • Python/Django: Use the os.path.abspath() function to validate and sanitize file paths.
  • PHP: Use the realpath() function to validate and sanitize file paths.

You can ask an AI coding assistant to review your code for potential CWE-59 Improper Link Resolution Before File Access (‘Link Following’) vulnerabilities and rewrite it using the primary fix technique.

Copy-paste prompt

Review the following [language] code block for potential CWE-59 Improper Link Resolution Before File Access ('Link Following') vulnerabilities and rewrite it using the primary fix technique: [paste code here]

Here is a checklist of best practices to prevent Improper Link Resolution Before File Access (‘Link Following’):

✅ Validate and sanitize file paths before attempting to access files. ✅ Deny access to files that can be replaced with links to sensitive files. ✅ Ensure good compartmentalization in the system.

Improper Link Resolution Before File Access (‘Link Following’) occurs when the product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

The common consequences of Improper Link Resolution Before File Access (‘Link Following’) include reading files or directories, modifying files or directories, and bypassing protection mechanisms. Additionally, in some cases, an attacker may be able to execute unauthorized code or commands.

Improper Link Resolution Before File Access (‘Link Following’) can be detected through manual testing, automated scanners (SAST / DAST), and PenScan’s detection capabilities. It is essential to follow proper false positive guidance when interpreting the results.

Some best practices for preventing Improper Link Resolution Before File Access (‘Link Following’) include following the principle of least privilege, denying access to files that can be replaced with links to sensitive files, and ensuring good compartmentalization in the system.

Improper Link Resolution Before File Access (‘Link Following’) affects various frameworks and platforms, including Java, C++, Python/Django, and PHP. Each of these has its specific fixes and mitigation strategies.

You can ask an AI coding assistant to review your code for potential CWE-59 Improper Link Resolution Before File Access (‘Link Following’) vulnerabilities and rewrite it using the primary fix technique.

Some common mistakes to avoid when fixing Improper Link Resolution Before File Access (‘Link Following’) include not properly canonicalizing input, not verifying that the resolved filename is within an allowed base directory, and not following proper least privilege principles.

Here is a table of vulnerabilities related to Improper Link Resolution Before File Access (‘Link Following’):

CWE ID Name Relationship
CWE-706 Use of Incorrectly-Resolved Name or Reference ChildOf

References

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Improper Link Resolution Before File Access (‘Link Following’) and other risks before an attacker does.