CVE-2026-56651
Received Received - Intake

Symlink Following Vulnerability in Dool via Missing O_NOFOLLOW Flag

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: CERT.PL

Description
Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without the "O_NOFOLLOW" flag. A local attacker can exploit this by creating a symlink at the expected log file path pointing to a sensitive file, causing dool to truncate and overwrite the target file with log data, which is especially impactful if dool is run with elevated privileges. The issue was addressed by pull request #116

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-56651
EUVD
EUVD-2026-67129

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
scottchiefbaker dool to 1.3.8 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-56651 is a symlink following vulnerability in dool versions up to 1.3.8. When the --devel flag is used, the application opens a log file without the O_NOFOLLOW flag. A local attacker can create a symlink at the log file path pointing to a sensitive file, causing dool to overwrite the target file with log data, especially dangerous if run with elevated privileges.

Detection Guidance

Check if dool versions up to 1.3.8 are installed on your system. Look for the presence of the --devel flag in running processes or scripts. Monitor log files for unexpected truncation or overwrites, especially if dool runs with elevated privileges.

Impact Analysis

This vulnerability allows a local attacker to overwrite sensitive files by exploiting symlink creation. If dool runs with elevated privileges, the attacker could corrupt or delete critical system files, leading to denial of service or unauthorized data access.

Mitigation Strategies

Update dool to the latest version that includes the fix from pull request #116. Avoid using the --devel flag if possible. Ensure dool does not run with elevated privileges to limit potential damage from exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56651. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart