CVE-2026-5958 Details
Description
When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path: 1. resolves symlink to its target and stores the resolved path for determining when output is written, 2. opens the original symlink path (not the resolved one) to read the file. Between these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1. This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process. This issue was fixed in version 4.10.
A vulnerability exists in GNU sed versions from 4.1e prior to 4.10, when the tool is used with the '-i' option for in-place editing and '--follow-symlinks'. The issue arises from a time-of-check time-of-use (TOCTOU) race condition, where the 'open_next_file()' function performs two separate, non-atomic operations on the same symlinked path. First, it resolves the symlink to its target and records the resolved path for output purposes. Then, it opens the original symlink path to read the file. This creates a race window during which an attacker could replace the symlink with a different target. As a result, sed could read content from the new, attacker-chosen target and write the processed output to the previously recorded path, leading to an arbitrary file overwrite with attacker-controlled content.
Users can upgrade to GNU sed version 4.10 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 20, 2026CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/05/13/1 | CVE | |
| https://cert.pl/en/posts/2026/04/CVE-2026-5958 | [email protected] | AdvisoryRemedy |
| https://www.gnu.org/software/sed/ | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| GNU sed | < 4.10 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 13, 2026 | CVE Modified | CVE |
| Apr 20, 2026 | New CVE Received | [email protected] |