CWE-363: Race Condition Enabling Link Following
The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.
10 tracked CVEs are classified under this weakness.
Highest-risk vulnerabilities
- CVE-2024-27102 — Improper isolation of server file access in github.com/pterodactyl/wings
- CVE-2025-52565 — container escape due to /dev/console mount and related races
- CVE-2025-62596 — youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects
- CVE-2025-62161 — youki container escape via "masked path" abuse due to mount race conditions
- CVE-2025-52881 — runc: LSM labels can be bypassed with malicious config using dummy procfs files
- CVE-2025-31133 — runc container escape via "masked path" abuse due to mount race conditions
- CVE-2025-13492 — HP Image Assistant - Potential Escalation of Privilege
Recently published
- CVE-2025-13492 — HP Image Assistant - Potential Escalation of Privilege
- CVE-2025-52881 — runc: LSM labels can be bypassed with malicious config using dummy procfs files
- CVE-2025-52565 — container escape due to /dev/console mount and related races
- CVE-2025-31133 — runc container escape via "masked path" abuse due to mount race conditions
- CVE-2025-62596 — youki container escape and denial of service due to arbitrary write gadgets and procfs write redirects
- CVE-2025-62161 — youki container escape via "masked path" abuse due to mount race conditions
- CVE-2024-27102 — Improper isolation of server file access in github.com/pterodactyl/wings