CVE-2026-56651: Arbitrary File Overwrite via Symlink Following in dool project
Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without the "ONOFOLLOW" flag. A local attacker can exploit this by creating a symlink at the expected log file path pointing to a sensitive file, causing dool to truncate and overwrite the target file with log data, which is especially impactful if dool is run with elevated privileges. The issue was addressed by pull request #116
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
dool projectto a version that resolves this vulnerability.Fixed in 1.3.8
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems are exposed when dool is run with the "--devel" flag and a local attacker can create a symlink at the expected log-file path. The impact is greater when dool runs with elevated privileges, because the attacker-selected target may be overwritten with those privileges.
Does normal use without development mode trigger the vulnerable behavior?
The described symlink-following behavior occurs when the "--devel" flag is used. The provided information does not indicate that runs without this flag use the affected log-file handling.
What does an attacker need to exploit it?
An attacker needs local access sufficient to place a symlink at the path where dool expects to open its log file. The symlink must point to a file the dool process is permitted to truncate and overwrite.
What can be done before an update is applied?
Avoid running dool with the "--devel" flag, especially under elevated privileges. Restrict local users from creating or replacing files at the expected log-file path.