Join our Newsletter — 33% off our NHI Course

Symlink Race

A symlink race is a timing attack where a program checks a file path, then an attacker changes that path through a symbolic link before the program uses it. It commonly affects privileged file operations, allowing unintended reads, writes or overwrites if path validation and file handling are not done atomically.

A symlink race is a time-of-check to time-of-use problem. The vulnerable program inspects a pathname, assumes it still refers to the same file, and then later opens or modifies it after the attacker has swapped that path to a different target through a symbolic link.

The core weakness is not symbolic links themselves, but a gap between validation and use. If a privileged process resolves paths in multiple steps, an attacker who can influence the directory or filename at the right moment may redirect the operation to a file the program never intended to touch.

Symlink races are especially serious when the affected process runs with elevated privileges, writes to world-writable locations, or handles files supplied by an untrusted user. The impact can include unintended disclosure, overwrites, configuration corruption, and in some cases privilege escalation through file replacement or controlled writes.

The danger grows when the program trusts a filename without locking the object it actually intends to use. A path that looked safe during validation can become dangerous by the time the filesystem operation occurs, which makes the bug easy to miss in review and hard to reproduce reliably.

Where Exposure Usually Comes From

Exposure often appears in temporary directories, upload handlers, file cleanup routines, log rotation, backup jobs, installers, and maintenance scripts. Any workflow that checks permissions first and opens the file later is a candidate, especially when it uses predictable names or operates in locations other users can modify.

Organisations should examine privilege boundaries, directory permissions, and whether file operations use atomic techniques such as open-then-verify patterns or flags that prevent following symbolic links. The same review should cover scripts and automation, not just long-running services, because short-lived privileged tasks are often overlooked.

Prevention and Response

Prevention depends on making the file reference and the action atomic. Prefer safe file-handling APIs, restrictive directory permissions, fixed trusted directories, and patterns that operate on file descriptors rather than on path strings after validation. Where possible, treat user-controlled filenames as untrusted data and avoid re-resolving them after a check.

If a symlink race is suspected, review the affected code path for path traversal, symbolic link following, temporary-file handling, and any privileged write or delete operation. Re-check the file state at the point of use, look for unexpected file ownership or modification time changes, and confirm whether any sensitive file was accessed, replaced, or overwritten.

Risk and Threat Considerations

Symlink races matter because they turn a routine file operation into an opportunity for attacker-controlled redirection. When the vulnerable process runs with higher privilege than the attacker, the result can be arbitrary file access or modification through a path the program believed was safe.

Failure mechanism: The attacker wins the timing window between the program’s validation step and its later file operation, causing the process to act on a different target than the one it inspected.

Impact: That mismatch can expose secrets, overwrite protected files, corrupt system configuration, or create a route to broader compromise if the altered file influences authentication, execution, or privilege handling.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework Control / Reference Relevance
NIST SP 800-53 Rev 5 AC-6 — Least Privilege Least privilege limits damage if a symlink race redirects a privileged file action.
SI-10 — Information Input Validation Path and filename handling rely on validating untrusted input before use.
CM-6 — Configuration Settings Safe file-handling defaults and directory permissions are configuration controls that reduce race exposure.
Recommendation — Reduce file-operation privilege so a raced path cannot modify protected files. Validate path inputs and reject unsafe file references before any privileged operation. Harden file and directory settings to prevent unsafe symbolic-link following.
CIS Controls v8 CIS-5 — Account Management Privileged file operations are safer when accounts and roles are tightly limited.
CIS-6 — Access Control Management Access control boundaries matter when attackers can redirect file paths in writable locations.
Recommendation — Restrict privileged accounts that can perform sensitive file operations. Limit write access to directories where symlink races could redirect privileged actions.

Practitioner Guidance

What to watch for: Any privileged workflow that validates a path and then uses it later should be treated as suspect, especially if the directory is writable by less-trusted users or automation. Review the code for atomic file handling rather than relying on a path check that can be invalidated before the operation completes.

Practitioner takeaway: The safest fix is to remove the race window, not to make the path check stricter.