CWE-363 Race Condition Enabling Link Following
Description
The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-363 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-cgrx-mc8f-2prm | CVE-2025-52881 | HIGH |
runc container escape and denial of service due to arbitrary write gadgets and procfs write redirects |
2025-11-18 | |
| GHSA-qw9x-cqr3-wc7r | CVE-2025-52565 | HIGH |
runc container escape with malicious config due to /dev/console mount and related races |
2025-11-18 | |
| GHSA-9493-h29p-rfm2 | CVE-2025-31133 | HIGH |
runc container escape via "masked path" abuse due to mount race conditions |
2025-11-18 | |
| GHSA-vf95-55w6-qmrf | CVE-2025-62596 | HIGH | - |
youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects |
2025-11-15 |
| GHSA-4g74-7cff-xcv8 | CVE-2025-62161 | HIGH | - |
youki container escape via "masked path" abuse due to mount race conditions |
2025-11-15 |
| GHSA-jfvp-7x6p-h2pv | CVE-2024-45310 | MODERATE |
runc can be confused to create empty files/directories on the host |
2025-02-21 | |
| GHSA-494h-9924-xww9 | CVE-2024-27102 | CRITICAL |
Pterodactyl Wings vulnerable to improper isolation of server file access |
2024-03-15 |