Dool symlink and CSV flaws disclosed
CERT Polska coordinated disclosure of two local vulnerabilities in Dool monitoring tool allowing file overwrite and CSV formula injection.
CERT Polska disclosed two vulnerabilities in the Dool system monitoring utility (versions up to 1.3.8), reported by researchers from the AFINE team. CVE-2026-56651 is a symlink-following issue that occurs when Dool is run with the --devel flag; because the log file is opened without the O_NOFOLLOW flag, a local attacker can pre-create a symlink at the expected log path pointing to a sensitive file, causing Dool to truncate and overwrite that file. This is especially dangerous when Dool runs with elevated privileges, potentially enabling local privilege escalation or denial of service via arbitrary file corruption.
CVE-2026-56652 is a CSV injection vulnerability in Dool's CSV export feature. The application fails to sanitize cell content that begins with formula trigger characters (=, +, -, @), allowing a local attacker to run a process with a maliciously crafted name that gets embedded in the exported CSV. When a victim later opens this file in a spreadsheet application, the injected formula can execute, potentially leading to further compromise on the victim's machine.
Both issues require local access to exploit and have been fixed upstream via pull requests #116 and #117 respectively. There is no indication of active exploitation in the wild; this is a standard coordinated disclosure. Defenders using Dool should update to a patched version and review use of the --devel flag and CSV export functionality in privileged contexts.
Mentioned in this report
Detection guidance
Dool Executed with --devel Flag
Detects execution of the dool monitoring utility with the --devel flag, which triggers logging without O_NOFOLLOW protection and is exploitable via pre-planted symlinks for privilege escalation or file corruption (CVE-2026-56651). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Dool Executed with --devel Flag
description: Detects dool being invoked with --devel, which opens its log file without
O_NOFOLLOW protection, making it vulnerable to symlink pre-planting attacks that
can truncate or overwrite arbitrary files when dool runs with elevated privileges.
tags:
- attack.privilege-escalation
- attack.t1574.005
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /dool
CommandLine|contains: --devel
condition: selection
falsepositives:
- Developers or administrators legitimately testing dool's debug/development mode
- Automated monitoring scripts that intentionally invoke dool in devel mode for diagnostics
level: low
id: 2e8abde5-7810-5a9d-93f8-32f92725bc85
status: experimental
author: Vorant
Symbolic Link Created Targeting Sensitive System Path
Detects creation of a symlink pointing at privileged or system-critical file paths, the precursor step used to hijack an application's log file write (as in the Dool --devel symlink-following flaw) for arbitrary file overwrite or privilege escalation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Symbolic Link Created Targeting Sensitive System Path
description: Detects use of ln -s to create a symbolic link pointing at sensitive
system files or directories (e.g. /etc, /root, /var/log). This is the pre-planting
step of a symlink-following attack, such as the Dool --devel log file overwrite
vulnerability, where a privileged process is tricked into truncating or overwriting
an attacker-chosen target.
tags:
- attack.privilege-escalation
- attack.t1574.005
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: /ln
CommandLine|contains:
- /etc/
- /root/
- /var/log/
filter_package_management:
ParentImage|endswith:
- /dpkg
- /rpm
- /apt
- /yum
condition: selection and not filter_package_management
falsepositives:
- System configuration scripts that legitimately create symlinks under /etc or /var/log
- Package installation/post-install scripts creating standard symlinks
level: medium
id: 77777554-3d33-5ef2-b3e7-1eb8c9b6da8c
status: experimental
author: Vorant
Process Executed With Formula-Injection-Style Name
Detects a process whose binary/basename begins with a spreadsheet formula trigger character (=, +, -, @), a technique used to plant CSV injection payloads that execute when exported monitoring data (e.g. Dool CSV export) is later opened in a spreadsheet application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Executed With Formula-Injection-Style Name
description: Detects execution of a process whose image basename starts with a spreadsheet
formula trigger character (=, +, -, @). Such unusual naming is the technique used
to plant CSV injection payloads via process listing/monitoring tools (e.g. Dool's
CSV export, CVE-2026-56652), which later execute when the exported CSV is opened
in a spreadsheet application.
tags:
- attack.execution
- attack.t1574.005
logsource:
category: process_creation
product: linux
detection:
selection:
Image|re: .*/[=+@-][^/]*$
condition: selection
falsepositives:
- Rare legitimate scripts or binaries with unconventional filenames starting with
these characters
- Testing or QA tooling that intentionally uses odd process names
level: medium
id: 24d1652f-d574-536b-8831-e303693005c2
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/08/CVE-2026-56651
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free