CVE-2026-73585

A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections.

Moderate: This flaw in sblim-cmpi-base provider registration scripts allows a local unprivileged attacker to overwrite root-owned files via a symlink attack in world-writable temporary directories. Exploitation requires specific conditions, including a privileged script execution and systems without sticky-directory symlink protections, which reduces its overall impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure sticky-directory symlink protections are enabled on your system. This can be done immediately by running sysctl -w fs.protected_symlinks=1. To make this change persistent across reboots, create or modify a file in /etc/sysctl.d/ (e.g., /etc/sysctl.d/99-sysctl.conf) with the content fs.protected_symlinks=1 and then run sysctl --system. Additionally, avoid running the sblim-cmpi-base provider registration scripts from shared multi-user systems where untrusted users can create symlinks in /tmp or /var/tmp. If manual execution of the script is necessary, prefer using a private, root-owned temporary directory.