A symbolic link (symlink) is a file system object that points to another file or directory by its path, so that programs opening the link are transparently redirected to the target.
How symbolic links work
A symbolic link stores only the path of its target. On Linux and macOS it is created with ln -s; Windows supports symbolic links via mklink as well as NTFS junctions and other reparse points. Unlike a hard link, a symlink can point across file systems or to a target that does not exist yet. Symlinks are widely used to manage software versions, shared configuration files and directory layouts.
Why symbolic links matter for security
The problem arises when a privileged program follows a link created by an attacker. The weakness is catalogued as CWE-59 (Improper Link Resolution Before File Access, “link following”). Typical scenarios:
- Temporary file attacks – a root process writes to a predictable file in
/tmp; an attacker places a symlink there pointing to/etc/passwdor another sensitive file, which is then overwritten. - Time-of-check to time-of-use – the file is swapped for a link between a security check and its use, a race condition (CWE-367).
- Windows service abuse – junctions and object manager links trick installers, update services or even antivirus products into deleting or writing arbitrary files with SYSTEM rights, a common route to local privilege escalation.
- Malicious archives – ZIP or tar files containing symlinks can make extraction tools write outside the target folder, much like directory traversal.
How to prevent symlink attacks
- On Linux, keep the
fs.protected_symlinkskernel setting enabled. - Create temporary files securely (for example with
mkstemp) and open files with flags such asO_NOFOLLOW. - Avoid file operations by privileged services in user-writable directories.
- Validate link targets when extracting archives.
