CVE-2026-56651 Arbitrary File Overwrite via Symlink Following in dool project
A local attacker can overwrite arbitrary files via symlink following when dool is run with the --devel flag, potentially causing data loss or system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-56651?
CVE-2026-56651 is a low-severity path traversal vulnerability in scottchiefbaker dool, published on 27 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without the "O_NOFOLLOW" flag. A local attacker can exploit this by creating a symlink at the expected log file path pointing to a sensitive file, causing dool to truncate and overwrite the target file with log data, which is especially impactful if dool is run with elevated privileges. The issue was addressed by pull request #116
Weakness: CWE-59
Which versions are affected by CVE-2026-56651?
How do I fix CVE-2026-56651?
No fix has been published for CVE-2026-56651 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-56651 being exploited?
There is no known exploitation of CVE-2026-56651 in the wild and no public exploit code.
Sources
Also known as GHSA-q9x7-4mx4-prwq.