What CVEs are caused by CWE-62?

2 recorded CVEs are attributed to CWE-62, including CVE-2024-54189, CVE-2024-36486.

What are the consequences of CWE-62?

Exploiting CWE-62 can lead to: Read Files or Directories, Modify Files or Directories.

Is CWE-62 actively exploited?

2 recorded CVEs are caused by CWE-62; none are currently in CISA's KEV catalog of actively exploited flaws.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Variant weakness

Incomplete

CWE-62: UNIX Hard Link

The product, when opening a file or directory, does not sufficiently account for when the name is associated with a hard link to a target that is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.

Last updated May 1, 2026

2

Recorded CVEs

With this primary weakness

0

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Variant

Abstraction

MITRE classification

Overview

Failure for a system to check for hard links can result in vulnerability to different types of attacks. For example, an attacker can escalate their privileges if a file used by a privileged program is replaced with a hard link to a sensitive file (e.g. /etc/passwd). When the process opens the file, the attacker can assume the privileges of that process.

Real-world CVEs

2 recorded CVEs are caused by CWE-62 (UNIX Hard Link). The highest-severity and most recent are shown first. 0 new CWE-62 CVEs have been recorded so far in 2026 (2 in 2025).

Common consequences

What can happen when CWE-62 is exploited.

Read Files or Directories, Modify Files or Directories

Affects: Confidentiality, Integrity

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Implementation

Applies to

Operating systems

Unix

How to prevent it

Practical mitigations for CWE-62, grouped by where in the lifecycle they apply.

Architecture and Design

Separation of Privilege

Follow the principle of least privilege when assigning access rights to entities in a software system.

Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2001-1494 — Hard link attack, file overwrite; interesting because program checks against soft links
CVE-2002-0793 — Hard link and possibly symbolic link following vulnerabilities in embedded operating system allow local users to overwrite arbitrary files.
CVE-2003-0578 — Server creates hard links and unlinks files as root, which allows local users to gain privileges by deleting and overwriting arbitrary files.
CVE-1999-0783 — Operating system allows local users to conduct a denial of service by creating a hard link from a device special file to a file on an NFS file system.
CVE-2004-1603 — Web hosting manager follows hard links, which allows local users to read or modify arbitrary files.
CVE-2004-1901 — Package listing system allows local users to overwrite arbitrary files via a hard link attack on the lockfiles.
CVE-2005-0342 — The Finder in Mac OS X and earlier allows local users to overwrite arbitrary files and gain privileges by creating a hard link from the .DS_Store file to an arbitrary file.
CVE-2005-1111 — Hard link race condition
CVE-2021-21272 — "Zip Slip" vulnerability in Go-based Open Container Initiative (OCI) registries product allows writing arbitrary files outside intended directory via symbolic links or hard links in a gzipped tarball.
CVE-2003-1366 — setuid root tool allows attackers to read secret data by replacing a temp file with a hard link to a sensitive file

Terminology & mappings

Mapped taxonomies

PLOVER: UNIX hard link
CERT C Secure Coding: Identify files using multiple file attributes (FIO05-C)
Software Fault Patterns: Link in resource name resolution (SFP18)

Frequently asked questions

Common questions about CWE-62.

What is CWE-62?: The product, when opening a file or directory, does not sufficiently account for when the name is associated with a hard link to a target that is outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
What CVEs are caused by CWE-62?: 2 recorded CVEs are attributed to CWE-62, including CVE-2024-54189, CVE-2024-36486.
How do you prevent CWE-62?: Follow the principle of least privilege when assigning access rights to entities in a software system.
What are the consequences of CWE-62?: Exploiting CWE-62 can lead to: Read Files or Directories, Modify Files or Directories.
Is CWE-62 actively exploited?: 2 recorded CVEs are caused by CWE-62; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-62

Get alerted the moment a new CWE-62 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing