GNU sed symlink race enables file overwrite

A TOCTOU race in GNU sed's -i --follow-symlinks option lets attackers overwrite arbitrary files; fixed in sed 4.10.

CERT Polska coordinated disclosure of CVE-2026-5958, a race condition vulnerability in GNU sed affecting the combination of the -i (in-place edit) and --follow-symlinks options. The flaw stems from open_next_file() performing two non-atomic filesystem operations on the same path: first resolving a symlink to determine the output destination, then separately opening the original symlink path to read content. An attacker who can atomically swap the symlink target between these two operations can cause sed to read attacker-controlled data and write it to the path resolved in the first step, resulting in arbitrary file overwrite in the context of the sed process.

Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-5958