EUVD-2026-23834
GHSA-9r7w-j29g-xqx8
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7DescriptionCVE.org
When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path:
- resolves symlink to its target and stores the resolved path for determining when output is written,
- opens the original symlink path (not the resolved one) to read the file.
Between these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1. This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process.
This issue was fixed in version 4.10.
AnalysisAI
GNU sed with -i (in-place edit) and --follow-symlinks options is vulnerable to a time-of-check-time-of-use (TOCTOU) race condition that allows local attackers to overwrite arbitrary files with attacker-controlled content. An attacker can atomically replace a symlink target between sed's symlink resolution and file open operations, causing sed to read from an attacker-chosen file while writing output to an unintended location. The vulnerability affects sed versions prior to 4.10 and requires precise timing on the same filesystem, resulting in a CVSS score of 2.1 due to low attack complexity but limited practical exploitation window.
Technical ContextAI
GNU sed is a stream editor utility that processes text based on supplied commands. The vulnerability exists in the open_next_file() function when both the -i flag (in-place file editing) and the --follow-symlinks option are enabled. The root cause is a classic TOCTOU race condition (CWE-367) where two filesystem operations occur non-atomically: first, sed calls readlink() or similar to resolve a symlink path and stores the resolved target path, then separately opens the original symlink path for reading. This two-step process creates a window where an attacker with local filesystem access can use atomic operations (like rename()) to change the symlink's target between these calls. When the race condition is won, sed reads from the new target (attacker-controlled file) but writes the output to the originally-resolved path, enabling arbitrary file overwrite in the context of the sed process's privileges and filesystem permissions.
RemediationAI
Upgrade GNU sed to version 4.10 or later. For systems unable to upgrade immediately, the most practical workaround is to avoid using the -i and --follow-symlinks flags together in the same sed invocation. If in-place editing of symlink-containing paths is required, either: (1) use sed -i without --follow-symlinks to edit the symlink itself rather than its target, accepting that the original file remains unchanged; or (2) use sed without -i and manually manage file replacement via a shell script with atomic mv operations, which mitigates the TOCTOU window. Additionally, restrict filesystem write permissions in directories containing symlinks that sed processes, and audit sed usage in privileged contexts (cron jobs, system scripts) to identify risky combinations. Vendors should backport the 4.10 fix to supported branches - consult your distribution's security advisory (see CERT-PL reference) for availability of patched packages.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today