Description

A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. A local attacker who can write to the destination directory can win that race and redirect the write to another file.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-07T16:17:30.713Z",
  "pubdate": "2026-09-07T16:17:30.713Z",
  "executiveSummary": "This vulnerability involves a race condition in the GLib2 library during the execution of g_file_replace().\nThe flaw occurs when the library attempts to create a temporary file using G_FILE_CREATE_REPLACE_DESTINATION; if this creation fails, the subsequent error-handling routine performs an unsafe unlink and recreation of the destination file.\nA local attacker with write access to the target directory can exploit this window by replacing the file with a symbolic link, thereby redirecting write operations to arbitrary files on the filesystem.\nThe vulnerability allows for local file overwrite or privilege escalation, depending on the permissions of the target file being redirected.\nSuccessful exploitation requires local access and the ability to win a race condition against the library's error-handling path.\nThis vulnerability does not require network exposure or authentication, as it relies on local filesystem interactions and race conditions during file handling.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper error-handling logic within the GLib2 file replacement functionality. When g_file_replace() is invoked with the G_FILE_CREATE_REPLACE_DESTINATION flag, the library attempts to write to a temporary file, typically named .goutputstream-XXXXXX.\nIf the creation of this temporary file fails, the library triggers a cleanup and fallback mechanism intended to recover from the failure. In this flawed implementation, the library proceeds to unlink the intended destination file and recreates it. Critically, the recreation process lacks exclusive creation (O_EXCL) flags and fails to implement necessary symlink protection checks.\nThe attack flow follows a race condition pattern: 1) The attacker monitors the target directory for the presence of the .goutputstream-XXXXXX temporary file or the specific file being replaced. 2) The attacker triggers the vulnerable application to perform the g_file_replace() operation. 3) The attacker induces a failure during the temporary file creation stage. 4) During the brief interval where the library unlinks the destination and prepares to recreate it, the attacker injects a symbolic link at the destination path pointing to a sensitive file (e.g., /etc/passwd or other configuration files). 5) Because the library recreates the file without verifying that the destination is not a symbolic link or ensuring the operation is atomic, the library follows the attacker's symlink and proceeds to write the application's output to the attacker-controlled target location.\nThe vulnerable component is the file handling routine in GLib2 that manages atomic replacements. This creates a Time-of-Check to Time-of-Use (TOCTOU) vulnerability. Because the recreation lacks proper security primitives such as O_NOFOLLOW or verifying ownership of the target directory before opening, the library effectively grants the attacker the ability to write to arbitrary files with the privileges of the user running the application. This can lead to full system compromise if the target application runs with elevated privileges, or unauthorized configuration changes if it runs as a standard user."
}