Hey fedi, I have a static site at ~/mysite/index.html and symlink to /var/www/mysite/index.html. The root of the site is /var/www/mysite. Is it possible for an attacker to act funny through symlinks and get access to my home directory?
@GNUxeava short answer: it depends.
Assuming there's no exploit available for your server of choice, the risk then becomes whether the attacker can create files. Creating files means the attacker can create symlinks and because you are already using symlinks, means the server cannot globally refuse to read symlinks.
So, by themselves, I think not, but it does make it trivial to expose arbitrary files once an attacker has some kind of limited access, e.g. file-creation.
See, for example: https://serverfault.com/questions/244592/followsymlinks-on-apache-why-is-it-a-security-risk
