GNU sed symlink race enables file overwrite

20 April 2026 medium vulnerability

A TOCTOU race in GNU sed 4.9 and earlier allows attackers to overwrite arbitrary files when -i and --follow-symlinks are used together.

CERT Polska coordinated disclosure of CVE-2026-5958, a time-of-check-time-of-use vulnerability in GNU sed that affects versions prior to 4.10. When sed is invoked with both the -i (in-place edit) and --follow-symlinks flags, the open_next_file() function performs two non-atomic operations: first resolving a symlink to its target, then opening the original symlink path. An attacker can exploit the race window between these calls by atomically replacing the symlink with a different target, causing sed to read from the attacker-chosen file and write the processed output to the originally-resolved path.

This vulnerability enables arbitrary file overwrite with attacker-controlled content in the context of the sed process. Exploitation requires the attacker to win a race condition and the victim to invoke sed with the specific flag combination on attacker-influenced symlinks. The issue has been fixed in sed version 4.10. Organizations running automated scripts or build systems that use sed with in-place editing should prioritize updating to the patched version.

Mentioned in this report

Vulnerabilities CVE-2026-5958

Detection guidance

GNU sed invoked with -i and --follow-symlinks (CVE-2026-5958 pattern)

ATT&CK T1222.002

Detects execution of GNU sed with the combination of in-place edit and follow-symlinks flags, the vulnerable flag combination enabling the TOCTOU symlink race in CVE-2026-5958. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: GNU sed Executed with -i and --follow-symlinks Flags
id: 4d98fb80-2489-5e11-8500-f2abafc88b11
status: experimental
description: 'Detects invocation of GNU sed with both the in-place edit flag (-i)
  and the

  --follow-symlinks flag. This exact flag combination triggers the

  non-atomic resolve-then-open logic in open_next_file() that is vulnerable

  to a symlink race (CVE-2026-5958), allowing an attacker who controls a

  symlink target to cause sed to overwrite an arbitrary file.

  '
logsource:
  category: process_creation
  product: linux
detection:
  selection_image:
    Image|endswith: /sed
  selection_inplace:
    CommandLine|re: (^|\s)-i(\S*)?(\s|$)|--in-place
  selection_symlink:
    CommandLine|contains: --follow-symlinks
  condition: selection_image and selection_inplace and selection_symlink
falsepositives:
- Legitimate automation or build scripts that intentionally use sed -i --follow-symlinks
  on trusted, non-attacker-writable paths
- Configuration management tools (Ansible, Puppet, Chef) that call sed with these
  flags for idempotent file edits
level: medium
tags:
- attack.t1222.002
- cve.2026-5958
author: Vorant

GNU sed with -i --follow-symlinks Targeting World-Writable Directories

ATT&CK T1222.002

Detects sed invoked with the vulnerable -i/--follow-symlinks flag combination against paths in commonly world-writable or shared directories (e.g. /tmp, /var/tmp, /dev/shm), which are the typical locations where an attacker could pre-stage a symlink to win the CVE-2026-5958 race. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Sed In-Place Symlink-Follow Edit Targeting Shared Writable Path
id: 316434e2-f50b-566e-9ae6-b5f09530dae9
status: experimental
description: 'Detects sed executed with -i and --follow-symlinks where the target
  path

  argument references a commonly world-writable directory such as /tmp,

  /var/tmp, or /dev/shm. These locations are the typical staging ground for

  an attacker-controlled symlink used to exploit the sed TOCTOU race

  (CVE-2026-5958) for arbitrary file overwrite.

  '
logsource:
  category: process_creation
  product: linux
detection:
  selection_image:
    Image|endswith: /sed
  selection_flags:
    CommandLine|contains: --follow-symlinks
  selection_inplace:
    CommandLine|re: (^|\s)-i(\S*)?(\s|$)|--in-place
  selection_path:
    CommandLine|contains:
    - /tmp/
    - /var/tmp/
    - /dev/shm/
  condition: selection_image and selection_flags and selection_inplace and selection_path
falsepositives:
- Build systems or CI pipelines that stage temporary files under /tmp and legitimately
  run sed -i --follow-symlinks against them
- Package installation scripts editing configuration templates copied to /tmp before
  final placement
level: high
tags:
- attack.t1222.002
- cve.2026-5958
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/04/CVE-2026-5958

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free