CVE-2026-5958
Severity CVSS v4.0:
LOW
Type:
Unavailable / Other
Publication date:
20/04/2026
Last modified:
13/05/2026
Description
When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path: <br />
1. resolves symlink to its target and stores the resolved path for determining when output is written,<br />
2. opens the original symlink path (not the resolved one) to read the file. <br />
Between these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1. This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process.<br />
<br />
<br />
This issue was fixed in version 4.10.
Impact
Base Score 4.0
2.10
Severity 4.0
LOW