---
id: CVE-2026-73585
title: >-
  Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider
  registration scripts allows local symlink attack
summary: >-
  A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the
  provider registration scripts allows a local unprivileged user to perform a
  symlink attack. By creating a symlink in a world-writable directory, an
  attacker can…
severity: medium
cvss: 6.3
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-377
vendor: Red Hat
product: sblim-cmpi-base
affected:
  - sblim-cmpi-base (all versions)
  - sblim-cmpi-base
  - sblim-cmpi-base (all versions)
  - sblim-cmpi-base (all versions)
  - sblim-cmpi-base (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-14T17:39:17.512074Z'
published: '2026-08-13'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T22:56:09.470Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-73585'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-73585'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2462235'
    label: RHBZ#2462235
tags:
  - cve.org
epss: 0.00143
epssPercentile: 0.03678
ingestedAt: '2026-11-05T23:41:31.935Z'
---

## Overview

A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections.

## Affected

- `sblim-cmpi-base (all versions)`
- `sblim-cmpi-base`
- `sblim-cmpi-base (all versions)`
- `sblim-cmpi-base (all versions)`
- `sblim-cmpi-base (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

To mitigate this issue, ensure sticky-directory symlink protections are enabled on your system. This can be done immediately by running `sysctl -w fs.protected_symlinks=1`. To make this change persistent across reboots, create or modify a file in `/etc/sysctl.d/` (e.g., `/etc/sysctl.d/99-sysctl.conf`) with the content `fs.protected_symlinks=1` and then run `sysctl --system`. Additionally, avoid running the `sblim-cmpi-base` provider registration scripts from shared multi-user systems where untrusted users can create symlinks in `/tmp` or `/var/tmp`. If manual execution of the script is necessary, prefer using a private, root-owned temporary directory.