Security

What is UNIX Symbolic Link (Symlink) Following (CWE-61)?

UNIX Symbolic Link (Symlink) Following (CWE-61) is a type of vulnerability that occurs when the product does not sufficiently account for symbolic links...

SP
Shreya Pillai July 27, 2026 5 min read Security
AI-friendly summary

What it is: UNIX Symbolic Link (Symlink) Following (CWE-61) is a type of vulnerability that occurs when the product does not sufficiently account for symbolic links, allowing an attacker to cause the product to operate on unauthorized files.

Why it matters: A UNIX Symbolic Link (Symlink) Following attack can result in the disclosure or modification of sensitive data, as well as denial-of-service attacks. This is a critical issue that requires immediate attention and remediation.

How to fix it: You can fix UNIX Symbolic Link (Symlink) Following by following the principle of least privilege when assigning access rights to entities in a software system and ensuring good compartmentalization in the system.

TL;DR: UNIX Symbolic Link (Symlink) Following (CWE-61) is a type of vulnerability that occurs when the product does not sufficiently account for symbolic links, allowing an attacker to cause the product to operate on unauthorized files. You can fix it by following the principle of least privilege and ensuring good compartmentalization in the system.

Field Value
CWE ID CWE-61
OWASP Category A01:2025 - Broken Access Control
CAPEC CAPEC-27
Typical Severity High
Affected Technologies Unix-based systems, Linux, macOS, BSD
Detection Difficulty Moderate
Last Updated 2026-07-27

UNIX Symbolic Link (Symlink) Following (CWE-61) is a type of vulnerability that occurs when the product does not sufficiently account for symbolic links, allowing an attacker to cause the product to operate on unauthorized files. As defined by the MITRE Corporation under CWE-61, and classified by the OWASP Foundation under A01:2025 - Broken Access Control, this vulnerability can have severe consequences, including the disclosure or modification of sensitive data, as well as denial-of-service attacks.

Quick Summary

UNIX Symbolic Link (Symlink) Following (CWE-61) is a critical issue that requires immediate attention and remediation. This type of vulnerability occurs when the product does not sufficiently account for symbolic links, allowing an attacker to cause the product to operate on unauthorized files. The consequences of a UNIX Symbolic Link (Symlink) Following attack can be severe, including the disclosure or modification of sensitive data, as well as denial-of-service attacks.

Jump to: Quick Summary · UNIX Symbolic Link (Symlink) Following Overview · How UNIX Symbolic Link (Symlink) Following Works · Business Impact of UNIX Symbolic Link (Symlink) Following · UNIX Symbolic Link (Symlink) Following Attack Scenario · How to Detect UNIX Symbolic Link (Symlink) Following · How to Fix UNIX Symbolic Link (Symlink) Following · Framework-Specific Fixes for UNIX Symbolic Link (Symlink) Following · How to Ask AI to Check Your Code for UNIX Symbolic Link (Symlink) Following · UNIX Symbolic Link (Symlink) Following Best Practices Checklist · UNIX Symbolic Link (Symlink) Following FAQ · Vulnerabilities Related to UNIX Symbolic Link (Symlink) Following · References · Scan Your Own Site

UNIX Symbolic Link (Symlink) Following (CWE-61) is a type of vulnerability that occurs when the product does not sufficiently account for symbolic links, allowing an attacker to cause the product to operate on unauthorized files. This can occur in various scenarios, including:

  • When a product uses external input to construct file paths without proper validation
  • When a product fails to follow the principle of least privilege when assigning access rights to entities in a software system
  • When a product neglects secure configuration settings

The root cause of UNIX Symbolic Link (Symlink) Following is the failure to account for symbolic links. This can occur when:

  1. A product uses external input to construct file paths without proper validation
  2. A product fails to follow the principle of least privilege when assigning access rights to entities in a software system
  3. A product neglects secure configuration settings

Root Cause

The root cause of UNIX Symbolic Link (Symlink) Following is the failure to account for symbolic links.

Attack Flow

  1. An attacker creates a symbolic link that points to an unauthorized file or directory.
  2. The product follows the symbolic link and operates on the unauthorized file or directory.

Prerequisites to Exploit

  • The product must use external input to construct file paths without proper validation
  • The product must fail to follow the principle of least privilege when assigning access rights to entities in a software system
  • The product must neglect secure configuration settings

Vulnerable Code

import os

path = request.args.get('path')
os.chdir(path)

This code is vulnerable because it uses external input to construct file paths without proper validation.

Secure Code

import os

path = request.args.get('path')
if not os.path.abspath(path).startswith(base_dir):
    raise ValueError("Invalid path")
else:
    os.chdir(path)

This code is secure because it properly validates the file path before operating on it.

The consequences of a UNIX Symbolic Link (Symlink) Following attack can be severe, including:

  • Disclosure or modification of sensitive data
  • Denial-of-service attacks
  • Unauthorized access to system resources
  1. An attacker creates a symbolic link that points to an unauthorized file or directory.
  2. The product follows the symbolic link and operates on the unauthorized file or directory.
  3. The attacker gains unauthorized access to sensitive data or disrupts system operations.

You can detect UNIX Symbolic Link (Symlink) Following using manual testing and automated scanners, such as PenScan’s scanner engines.

Manual Testing

  • Use a symbolic link to point to an unauthorized file or directory
  • Observe the product’s behavior when following the symbolic link
  • Verify that the product operates on the unauthorized file or directory

Automated Scanners (SAST / DAST)

  • Use a static analysis tool to identify potential vulnerabilities in the code
  • Use a dynamic testing tool to simulate an attack and verify that the product follows the symbolic link

PenScan Detection

Confirming an actual symlink-follow requires filesystem-level access this pipeline’s web-facing scanner engines don’t have — treat any indirect signal (predictable shared-directory file paths) as a prompt for manual verification rather than a direct PenScan finding.

False Positive Guidance

A finding on a file operation confined entirely to a directory the application exclusively owns (not shared with other, less-trusted users or processes) is a false positive — the weakness requires another party to be able to plant the symlink before the access happens.

You can fix UNIX Symbolic Link (Symlink) Following by following the principle of least privilege when assigning access rights to entities in a software system and ensuring good compartmentalization in the system.

Potential Mitigations

  • Follow the principle of least privilege when assigning access rights to entities in a software system
  • Ensure good compartmentalization in the system
  • Use access control lists to restrict access to sensitive data
  • Implement secure coding practices to prevent vulnerabilities

Java

import java.io.File;

File path = new File(request.get('path'));
if (!path.getAbsolutePath().startsWith(base_dir)) {
    throw new SecurityException("Invalid path");
} else {
    // proceed with the operation
}

This code is secure because it properly validates the file path before operating on it.

Node.js

const fs = require('fs');

const path = request.get('path');
if (!fs.existsSync(path) || !fs.lstatSync(path).isDirectory()) {
    throw new Error("Invalid path");
} else {
    // proceed with the operation
}

This code is secure because it properly validates the file path before operating on it.

Python/Django

import os

path = request.get('path')
if not os.path.abspath(path).startswith(base_dir):
    raise ValueError("Invalid path")
else:
    # proceed with the operation

This code is secure because it properly validates the file path before operating on it.

You can ask an AI coding assistant to review your code and identify potential vulnerabilities related to UNIX Symbolic Link (Symlink) Following. Here’s a sample prompt you can use:

“Review the following Python code block for potential CWE-61 UNIX Symbolic Link (Symlink) Following vulnerabilities and rewrite it using secure coding practices: [paste code here]”

✅ Follow the principle of least privilege when assigning access rights to entities in a software system ✅ Ensure good compartmentalization in the system ✅ Use access control lists to restrict access to sensitive data ✅ Implement secure coding practices to prevent vulnerabilities

UNIX Symbolic Link (Symlink) Following occurs when the product does not sufficiently account for symbolic links, allowing an attacker to cause the product to operate on unauthorized files.

A UNIX Symbolic Link (Symlink) Following attack can result in the disclosure or modification of sensitive data, as well as denial-of-service attacks.

You can detect UNIX Symbolic Link (Symlink) Following using manual testing and automated scanners, such as PenScan’s scanner engines.

You can fix UNIX Symbolic Link (Symlink) Following by following the principle of least privilege when assigning access rights to entities in a software system and ensuring good compartmentalization in the system.

Some best practices for preventing UNIX Symbolic Link (Symlink) Following attacks include following the principle of least privilege, using access control lists, and implementing secure coding practices.

Yes, AI can help you detect and prevent UNIX Symbolic Link (Symlink) Following attacks by analyzing your code for potential vulnerabilities and providing recommendations for remediation.

Some common mistakes that lead to UNIX Symbolic Link (Symlink) Following attacks include failing to account for symbolic links, using insecure coding practices, and neglecting secure configuration settings.

CWE Name Relationship
CWE-59 Improper Link Resolution Before File Access (‘Link Following’) ChildOf
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’) Requires
CWE-340 Generation of Predictable Numbers or Identifiers Requires
CWE-386 Symbolic Name not Mapping to Correct Object Requires
CWE-732 Incorrect Permission Assignment for Critical Resource Requires

References

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find UNIX Symbolic Link (Symlink) Following and other risks before an attacker does.