---
title: "NET-DB-014 MySQL Symbolic Links Allowed for Tables"
canonical: https://openvapt.com/checks/NET-DB-014.html
html: https://openvapt.com/checks/NET-DB-014.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# NET-DB-014 MySQL Symbolic Links Allowed for Tables

MySQL or MariaDB does not disable symbolic links for table files (skip-symbolic-links or symbolic-links=0).

- Domain: Network
- Severity: Medium
- Control category: Data Services
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L`
- CIS Controls v8: 3.3
- NIST CSF 2.0: PR.AA-05, PR.DS-01
- CWE: CWE-59, CWE-732
- OWASP Top 10 2021: A05:2021
- OWASP ASVS 4.0.3: 14.1.3
- NIST SP 800-53 Rev. 5: CM-6, AC-6
- Benchmark topic: Database server hardening (topic only, no benchmark text)

## Why It Matters

With symlinks allowed, a user who can create tables can point table files at paths outside the data directory and read or overwrite them with the server's privileges. The MySQL manual recommends disabling the feature unless it is needed.

## How It Detects

Parses the MySQL and MariaDB option files for skip-symbolic-links, symbolic-links or skip_symbolic_links under [mysqld]. When none disables the feature, reads the server flavour and version (the MariaDB binary or option folder, installed packages in the dpkg status file or the allow-listed rpm -qa): fails on MariaDB and MySQL before 8.0, passes with a note on MySQL 8.0 and later (off by default), and reports Incomplete when the version cannot be read.

## How to Fix

Add  symbolic-links=0  (or  skip-symbolic-links ) under [mysqld] and restart the service in a maintenance window.

## How to Verify

```
SHOW VARIABLES LIKE 'have_symlink';  from an administrator session should print DISABLED.
```

## Learn the Theory

- [P3 Network Exposure and Firewalls](https://openvapt.com/academy/p3.md)
- [P8 Data Services: Databases, File Shares, DNS and Mail](https://openvapt.com/academy/p8.md)
- [P19 Database, Mail and DNS Hardening](https://openvapt.com/academy/p19.md)

## References

- [MySQL 8.4 Reference Manual, Using Symbolic Links](https://dev.mysql.com/doc/refman/8.4/en/symbolic-links.html)
- [MySQL 8.4 Reference Manual, Security Guidelines](https://dev.mysql.com/doc/refman/8.4/en/security-guidelines.html)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/network/data_depth.go

Run it: `openvapt scan --only NET-DB-014`. Read it offline: `openvapt explain NET-DB-014`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/NET-DB-014.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.