CVE-2026-56651
LowCVSS 2.0Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without the "O_NOFOLLOW" flag. A local attacker can exploit this by creating a symlink at the expected log file path pointing to a sensitive file, causing dool to truncate and overwrite the target file with log data, which is especially impactful if dool is run with elevated privileges. The issue was addressed by pull request #116.
Risk Assessment
A local attacker could overwrite sensitive files, potentially leading to data integrity compromise, data loss, or privilege escalation if dool runs with elevated privileges.
Recommendation
Update dool to a version containing the fix from pull request #116 or later. Avoid using the --devel flag with elevated privileges if possible.
Original NVD description (English source)
Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without the "O_NOFOLLOW" flag. A local attacker can exploit this by creating a symlink at the expected log file path pointing to a sensitive file, causing dool to truncate and overwrite the target file with log data, which is especially impactful if dool is run with elevated privileges. The issue was addressed by pull request #116