EUVD-2026-67129
GHSA-q9x7-4mx4-prwq
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only attack requiring non-default --devel flag and symlink race condition (AC:H); attacker needs no privileges but a user must trigger execution (UI:R); impact is write-only file truncation with no confidentiality loss (I:L, C:N, A:N).
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
2DescriptionCVE.org
Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without the "O_NOFOLLOW" flag. A local attacker can exploit this by creating a symlink at the expected log file path pointing to a sensitive file, causing dool to truncate and overwrite the target file with log data, which is especially impactful if dool is run with elevated privileges. The issue was addressed by pull request #116
AnalysisAI
Symlink following in Dool (versions up to and including 1.3.8) allows a local attacker to cause arbitrary file truncation and overwriting when the tool is run with the non-default '--devel' flag. The vulnerable code path opens a log file without the O_NOFOLLOW flag (CWE-59), allowing a pre-placed symlink to redirect the write to any file the dool process can access - an impact that escalates from trivial to severe if dool runs under elevated privileges such as root. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three concurrent conditions must be met for exploitation: (1) dool must be invoked with the explicit '--devel' flag, which is a non-default development/debugging option not present in standard operational use; (2) the attacker must have local filesystem write access to the directory where dool expects to create its log file, enabling symlink pre-placement; and (3) for impact beyond files already owned by the running user, dool must be executing with elevated privileges (root or sudo). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 2.0 accurately reflects constrained real-world risk under typical conditions: the attack vector is local (AV:L), specific attack requirements must be met (AT:P - the '--devel' flag must be in use), passive user interaction is required (UI:P - a user or scheduled process must invoke dool), and the vulnerable-system integrity impact is rated Low (VI:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix from GitHub pull request #116 (https://github.com/scottchiefbaker/dool/pull/116) by pulling the latest commit from the repository or waiting for a tagged release that incorporates it; a specific patched version number is not confirmed at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-59 – Improper Link Resolution Before File Access
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today