{"id":"CVE-2026-73585","title":"Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack","summary":"A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can…","severity":"medium","cvss":6.3,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","cvssSource":"cna","cwe":["CWE-377"],"vendor":"Red Hat","product":"sblim-cmpi-base","affected":["sblim-cmpi-base (all versions)","sblim-cmpi-base","sblim-cmpi-base (all versions)","sblim-cmpi-base (all versions)","sblim-cmpi-base (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-14T17:39:17.512074Z"},"published":"2026-08-13","updated":"2026-11-05","sourceUpdated":"2026-11-05T22:56:09.470Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-73585","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-73585"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2462235","label":"RHBZ#2462235"}],"tags":["cve.org"],"epss":0.00143,"epssPercentile":0.03678,"ingestedAt":"2026-11-05T23:41:31.935Z","slug":"CVE-2026-73585","body":"## Overview\n\nA flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections.\n\n## Affected\n\n- `sblim-cmpi-base (all versions)`\n- `sblim-cmpi-base`\n- `sblim-cmpi-base (all versions)`\n- `sblim-cmpi-base (all versions)`\n- `sblim-cmpi-base (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nTo mitigate this issue, ensure sticky-directory symlink protections are enabled on your system. This can be done immediately by running `sysctl -w fs.protected_symlinks=1`. To make this change persistent across reboots, create or modify a file in `/etc/sysctl.d/` (e.g., `/etc/sysctl.d/99-sysctl.conf`) with the content `fs.protected_symlinks=1` and then run `sysctl --system`. Additionally, avoid running the `sblim-cmpi-base` provider registration scripts from shared multi-user systems where untrusted users can create symlinks in `/tmp` or `/var/tmp`. If manual execution of the script is necessary, prefer using a private, root-owned temporary directory.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":34.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}