Dool symlink and CSV flaws disclosed
CERT Polska coordinated disclosure of two local vulnerabilities in Dool monitoring tool allowing file overwrite and CSV formula injection.
Sourcecert.pl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska disclosed two vulnerabilities in the Dool system monitoring utility (versions up to 1.3.8), reported by researchers from the AFINE team. CVE-2026-56651 is a symlink-following issue that occurs when Dool is run with the --devel flag; because the log file is opened without the O_NOFOLLOW flag, a local attacker can pre-create a symlink at the expected log path pointing to a sensitive file, causing Dool to truncate and overwrite that file. This is especially dangerous when Dool runs with elevated privileges, potentially enabling local privilege escalation or denial of service via arbitrary file corruption.
CVE-2026-56652 is a CSV injection vulnerability in Dool's CSV export feature. The application fails to sanitize cell content that begins with formula trigger characters (=, +, -, @), allowing a local attacker to run a process with a maliciously crafted name that gets embedded in the exported CSV. When a victim later opens this file in a spreadsheet application, the injected formula can execute, potentially leading to further compromise on the victim's machine.
Both issues require local access to exploit and have been fixed upstream via pull requests #116 and #117 respectively. There is no indication of active exploitation in the wild; this is a standard coordinated disclosure. Defenders using Dool should update to a patched version and review use of the --devel flag and CSV export functionality in privileged contexts.
Mentioned in this report
Detection guidance
Dool Executed with --devel Flag
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects execution of the dool monitoring utility with the --devel flag, which triggers logging without O_NOFOLLOW protection and is exploitable via pre-planted symlinks for privilege escalation or file corruption (CVE-2026-56651). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Dool Executed with --devel Flag
description: Detects dool being invoked with --devel, which opens its log file without
O_NOFOLLOW protection, making it vulnerable to symlink pre-planting attacks that
can truncate or overwrite arbitrary files when dool runs with elevated privileges.
tags:
- attack.privilege-escalation
- attack.t1574.005
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /dool
CommandLine|contains: --devel
condition: selection
falsepositives:
- Developers or administrators legitimately testing dool's debug/development mode
- Automated monitoring scripts that intentionally invoke dool in devel mode for diagnostics
level: low
id: 2e8abde5-7810-5a9d-93f8-32f92725bc85
status: experimental
author: Vorant
Symbolic Link Created Targeting Sensitive System Path
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of a symlink pointing at privileged or system-critical file paths, the precursor step used to hijack an application's log file write (as in the Dool --devel symlink-following flaw) for arbitrary file overwrite or privilege escalation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Symbolic Link Created Targeting Sensitive System Path
description: Detects use of ln -s to create a symbolic link pointing at sensitive
system files or directories (e.g. /etc, /root, /var/log). This is the pre-planting
step of a symlink-following attack, such as the Dool --devel log file overwrite
vulnerability, where a privileged process is tricked into truncating or overwriting
an attacker-chosen target.
tags:
- attack.privilege-escalation
- attack.t1574.005
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /ln
CommandLine|contains:
- /etc/
- /root/
- /var/log/
filter_package_management:
ParentImage|endswith:
- /dpkg
- /rpm
- /apt
- /yum
condition: selection and not filter_package_management
falsepositives:
- System configuration scripts that legitimately create symlinks under /etc or /var/log
- Package installation/post-install scripts creating standard symlinks
level: medium
id: 77777554-3d33-5ef2-b3e7-1eb8c9b6da8c
status: experimental
author: Vorant
Process Executed With Formula-Injection-Style Name
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a process whose binary/basename begins with a spreadsheet formula trigger character (=, +, -, @), a technique used to plant CSV injection payloads that execute when exported monitoring data (e.g. Dool CSV export) is later opened in a spreadsheet application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Executed With Formula-Injection-Style Name
description: Detects execution of a process whose image basename starts with a spreadsheet
formula trigger character (=, +, -, @). Such unusual naming is the technique used
to plant CSV injection payloads via process listing/monitoring tools (e.g. Dool's
CSV export, CVE-2026-56652), which later execute when the exported CSV is opened
in a spreadsheet application.
tags:
- attack.execution
- attack.t1574.005
logsource:
category: process_creation
product: linux
detection:
selection:
Image|re: .*/[=+@-][^/]*$
condition: selection
falsepositives:
- Rare legitimate scripts or binaries with unconventional filenames starting with
these characters
- Testing or QA tooling that intentionally uses odd process names
level: medium
id: 24d1652f-d574-536b-8831-e303693005c2
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/08/CVE-2026-56651
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs