CVE-2026-73585

Analyzed Analyzed - Analysis Complete

Insecure Temporary File Handling in sblim-cmpi-base

Publication date: 2026-08-13

Last updated on: 2026-08-25

Assigner: redhat-SADP

Description

A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-13

Last Modified

2026-08-25

Generated

2026-09-03

AI Q&A

2026-08-13

EPSS Evaluated

2026-09-01

NVD

CVE-2026-73585

EUVD

EUVD-2026-57827

Affected Vendors & Products

Vendor	Product	Version / Range
redhat	enterprise_linux	7.0
redhat	enterprise_linux	6.0
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0
redhat	enterprise_linux	10.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-377	Creating and using insecure temporary files can leave application and system data vulnerable to attack.

Attack-Flow Graph

Executive Summary

CVE-2026-73585 is a flaw in the sblim-cmpi-base package affecting provider registration scripts. It involves insecure temporary file creation in world-writable directories like /tmp or /var/tmp. Predictable filenames allow local attackers to create symlinks that redirect privileged writes to arbitrary files during script execution with elevated privileges. This can lead to overwriting root-owned files and disrupting system services.

Detection Guidance

Check for the presence of vulnerable scripts in sblim-cmpi-base by running: rpm -q sblim-cmpi-base. Inspect world-writable directories like /tmp and /var/tmp for symlinks pointing to sensitive files. Monitor script execution during package installation or updates with commands like rpm -ivh --test or rpm -Uvh --test.

Impact Analysis

If exploited, this vulnerability could allow a local attacker to overwrite critical system files, potentially causing service disruptions or system instability. It requires the attacker to have local access and for the vulnerable scripts to run with elevated privileges. Systems without sticky-directory symlink protections are at higher risk.

Compliance Impact

This vulnerability primarily affects system integrity and availability by allowing local attackers to overwrite root-owned files through symlink attacks in world-writable directories. While it does not directly expose sensitive data, it could disrupt critical system services, potentially violating compliance requirements for availability and integrity in standards like HIPAA (which mandates system reliability for protected health information) and GDPR (which requires secure processing environments).

Mitigation Strategies

Enable sticky-directory symlink protections by running: echo 1 > /proc/sys/fs/protected_symlinks. Avoid running vulnerable scripts in shared multi-user environments. Use private temporary directories for manual execution. Monitor for unauthorized file modifications in root-owned directories.

Hi! I’m here to help you understand CVE-2026-73585. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70