{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sblim-cmpi-base","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sblim-cmpi-base","product":"Red Hat Enterprise Linux 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sblim-cmpi-base","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sblim-cmpi-base","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"sblim-cmpi-base","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-73585","cwes":["CWE-377"],"description":"A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections.","epss":{"date":"2026-11-05","percentile":0.03678,"score":0.00143},"exploits":[],"kev":null,"metrics":[{"score":6.3,"severity":"medium","source":"CNA: redhat","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","version":"3.1"}],"modifiedAt":1793919369470,"publishedAt":1786625049267,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-73585"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2462235"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"To mitigate this issue, ensure sticky-directory symlink protections are enabled on your system. This can be done immediately by running `sysctl -w fs.protected_symlinks=1`. To make this change persistent across reboots, create or modify a file in `/etc/sysctl.d/` (e.g., `/etc/sysctl.d/99-sysctl.conf`) with the content `fs.protected_symlinks=1` and then run `sysctl --system`. Additionally, avoid running the `sblim-cmpi-base` provider registration scripts from shared multi-user systems where untrusted users can create symlinks in `/tmp` or `/var/tmp`. If manual execution of the script is necessary, prefer using a private, root-owned temporary directory."}],"revision":"49ba35c75dcb7d9e88a0667e899fbe04e34102d1752bb84c97df536a83dbe90c","sources":[{"modifiedAt":1793919369470,"name":"CNA: redhat","retrievedAt":1793920174609,"url":"https://www.cve.org/CVERecord?id=CVE-2026-73585"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793920181684,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-73585"}],"ssvc":{"assessedAt":1786729157512,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack","updatedAt":1793920181684}