Arbitrary File Overwrite in GNU sed due to Symlink Handling Vulnerability

CVE-2026-5958

What is CVE-2026-5958?

A symlink handling vulnerability exists in GNU sed when invoked with the -i option for in-place edits coupled with --follow-symlinks. This flaw arises due to two non-atomic operations performed on the same path during symlink resolution. Specifically, sed resolves the symlink target and prepares to write output, while concurrently opening the original symlink path to read its content. This introduces a race condition where an attacker can replace the symlink with a different target, leading to sed potentially overwriting files with content chosen by the attacker. This security issue necessitates patching to version 4.10 or later to mitigate the risk.

References