CVE-2026-5958
Gravedad CVSS v4.0:
BAJA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
20/04/2026
Última modificación:
20/04/2026
Descripción
*** Pendiente de traducción *** When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path: <br />
1. resolves symlink to its target and stores the resolved path for determining when output is written,<br />
2. opens the original symlink path (not the resolved one) to read the file. <br />
Between these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1. This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process.<br />
<br />
<br />
This issue was fixed in version 4.10.
Impacto
Puntuación base 4.0
2.10
Gravedad 4.0
BAJA