# Symlink following privilege escalation

Privileged reads, writes or deletes through paths a lower-privileged actor can replace with a symlink or reparse point

_Area: Web infrastructure and server-side requests. Seen in 5 disclosed reports; 3 confirmed bounties, median $1,250, range $249-$2,400; latest 2024-10-16. Updated 2026-10-23._

## How it works
A privileged process (root service, SYSTEM service, or a process holding secrets) operates on a file path that an unprivileged party can delete, recreate, or redirect. The code assumes the path still names the regular file it expected, but the filesystem resolves it to a symlink, NTFS reparse point/junction, or a `..`-laden archive entry. The privileged read, write, or delete then lands on a target the attacker chose, crossing the trust boundary the path was meant to enforce. The same assumption breaks when a sandbox gates by path string but the operation accepts a file descriptor instead.

## Where it shows up
- Archive extraction using `filepath.Join(dst, header.Name)` where only a prefix is stripped, so `../` escapes the temp dir [E1](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-cdnjs-remote-code-execution-en.md)
- File-copy helpers that dereference git symlinks when moving files [E1](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-cdnjs-remote-code-execution-en.md)
- Log/config paths built from user-writable registry or config values, written without checking the resolved path [E2](https://bugbountylibrary.com/r/h1%3A682774.md)
- World-writable (chmod 666) log files any local user can delete and recreate [E3](https://bugbountylibrary.com/r/h1%3A1872682.md)
- SYSTEM services that recursively delete a predictable, user-writable directory on restart [E4](https://bugbountylibrary.com/r/h1%3A959815.md)
- Permission layers that check path strings but not file descriptors (`fchown`/`fchmod` on a read-only fd) [E5](https://bugbountylibrary.com/r/h1%3A2590608.md)

## How to review
Find every path a privileged process reads, writes, or deletes where a lower-privileged actor controls the directory or the path string. The invariant: the resolved target must be a regular file inside an expected root, with no symlink/reparse component, and that must hold at the moment of the operation, not before it. Check for `O_NOFOLLOW`, `openat` relative to a trusted dirfd, `fstat` after open (not `lstat`-then-open, which races), realpath containment, and archive entry sanitization rejecting `..` and absolute names. On Windows, check for reparse-point/junction handling and `\..\` normalization in registry-derived paths [E2](https://bugbountylibrary.com/r/h1%3A682774.md)[E4](https://bugbountylibrary.com/r/h1%3A959815.md). For sandboxes, verify fd-based APIs are gated too [E5](https://bugbountylibrary.com/r/h1%3A2590608.md).

## Variants seen
- Tar path traversal plus symlink-following copy during package ingestion [E1](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-cdnjs-remote-code-execution-en.md)
- Registry-controlled path redirected via NTFS symlinks to SYSTEM-writable locations [E2](https://bugbountylibrary.com/r/h1%3A682774.md)
- World-writable log replaced by symlink to a private key, read via web UI [E3](https://bugbountylibrary.com/r/h1%3A1872682.md)
- Junction/mount-point redirecting a SYSTEM recursive delete [E4](https://bugbountylibrary.com/r/h1%3A959815.md)
- Path-gated permission model bypassed via file-descriptor operations [E5](https://bugbountylibrary.com/r/h1%3A2590608.md)

## Impact and severity
Led to RCE and token leakage [E1](https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-cdnjs-remote-code-execution-en.md), SYSTEM-level arbitrary file creation [E2](https://bugbountylibrary.com/r/h1%3A682774.md), private key disclosure [E3](https://bugbountylibrary.com/r/h1%3A1872682.md), and arbitrary folder deletion as SYSTEM [E4](https://bugbountylibrary.com/r/h1%3A959815.md). Severity rises when the privileged process holds secrets or runs as root/SYSTEM, and when the attacker needs no local account.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-cdnjs-remote-code-execution-en.md
- E2: https://bugbountylibrary.com/r/h1%3A682774.md
- E3: https://bugbountylibrary.com/r/h1%3A1872682.md
- E4: https://bugbountylibrary.com/r/h1%3A959815.md
- E5: https://bugbountylibrary.com/r/h1%3A2590608.md