CVE-2026-12345

Executive Summary

CVE-2026-12345 identifies a race condition in the cleanup routine of Python's tempfile.TemporaryDirectory (which uses shutil.rmtree). An attacker capable of modifying the temporary directory tree during cleanup can replace a directory entry with a symbolic link, causing files outside the temporary tree to be deleted or have their permissions and file flags reset with the privileges of the process performing cleanup. This class of vulnerability (CWE-59: Improper Link Resolution Before File Access) primarily affects multi-user systems, long-running services, or shared environments where an untrusted local user can interact with a temporary directory owned by a more privileged process.

Technical Analysis

The vulnerability resides in the interaction between Python's tempfile.TemporaryDirectory cleanup logic and shutil.rmtree. When a TemporaryDirectory object is garbage-collected or explicitly cleaned up, the implementation calls shutil.rmtree to recursively delete the directory tree. shutil.rmtree traverses the directory tree, and for each entry it performs operations such as unlinking files, resetting file flags (e.g., via os.chflags or similar), and removing directories.

The race condition arises because the tree is inspected and then acted upon in separate steps without holding a consistent lock or verifying that entries have not changed type between inspection and deletion. An attacker who has write access to a subdirectory within the temporary tree can, during the cleanup window, remove a real directory and replace it with a symbolic link pointing to a target directory outside the temporary tree (e.g., /etc or a user's home directory). If the cleanup process subsequently follows the symlink (or operates on it in a way that resolves the link), it may delete files outside the intended tree or reset permissions and file flags on those external files.

The NVD description explicitly notes two important caveats:

1. On platforms where shutil.rmtree.avoids_symlink_attacks is false, the system remains affected by symlink-based attacks. This attribute is a platform-dependent flag indicating whether the underlying rmtree implementation is resistant to symlink attacks (e.g., using os.scandir with os.unlink and os.rmdir in a way that does not follow symlinks). Where this is false, the cleanup may follow a symlink.
2. Even on platforms where symlink attacks are avoided, file flags may still be reset outside of the tree on all platforms. This indicates a separate, platform-independent issue where the flag-resetting operation (e.g., clearing immutable or append-only flags) may traverse a symlink and affect files outside the temporary directory.

The attack surface is local and requires the attacker to be able to create or manipulate files within the temporary directory tree. This is typical in scenarios where a privileged process creates a temporary directory in a world-writable location (such as /tmp) and an unprivileged user can write to subdirectories. The vulnerability is a classic time-of-check-time-of-use (TOCTOU) race condition combined with improper link resolution.

No public proof-of-concept or exploit code is available. The exact code path within tempfile or shutil that is vulnerable is not detailed beyond the NVD description; therefore, we refrain from speculating on specific function names or internal call sequences. The vulnerability class is well-understood: symlink-following during recursive deletion.

Exploitation Scenarios

No public PoC available; attack chain is inferred from vulnerability class (CWE-59).

1. Reconnaissance/target identification: An attacker gains local access to a multi-user system where a privileged process (e.g., a daemon running as root, a backup service, or a web application) periodically creates and cleans up tempfile.TemporaryDirectory instances. The attacker identifies a temporary directory that is created with permissions allowing other users to create or modify entries. This is often in a shared temporary directory such as /tmp or a designated scratch space.

2. Triggering the flaw class: The attacker monitors the temporary directory for the cleanup phase. During the window between when the cleanup process begins traversing the tree and when it acts on a specific subdirectory, the attacker replaces a directory entry with a symbolic link pointing to a target outside the tree. This requires the attacker to have write permissions on the parent directory of the subdirectory being replaced. The race is won if the cleanup process resolves the symlink and operates on the target.

3. Payload/execution method: The "payload" is the symlink itself. No code execution is required; the attacker simply creates a symlink using standard system calls (e.g., ln -s, os.symlink). The cleanup process, running with its own privileges, then performs deletion or flag-reset operations on the target of the symlink. For example, if the cleanup attempts to remove a file, it may delete a critical system file outside the temporary tree. If it resets file flags, it may remove immutable protections from sensitive files, enabling subsequent tampering.

4. Post-exploitation impact: The attacker can cause deletion of arbitrary files writable by the cleanup process, potentially leading to denial of service, data loss, or removal of security controls (e.g., deleting log files, configuration files, or even binaries). Resetting file flags can allow the attacker to modify files that were previously protected by immutable or append-only attributes, facilitating further attacks. The impact is constrained by the privileges of the process performing cleanup; if that process runs as root, the attacker can affect system-critical files.

Impact Assessment

The vulnerability allows a local attacker to delete or alter files outside the intended temporary directory, with the privileges of the process performing cleanup. This can lead to:

• Integrity impact: Modification or deletion of files, resetting of permissions and file flags, potentially removing security protections.
• Availability impact: Deletion of critical files can cause service disruption or system instability.
• Confidentiality impact: In some cases, if file flags are reset on sensitive files and the attacker later gains access, confidentiality may be breached. However, the primary impact is on integrity and availability.

The CVSS score is not available (N/A). Based on the vulnerability class, a reasonable assessment would involve local attack vector (AV:L), high complexity (AC:H) due to the race condition, and privileges required (PR:L) for the attacker to have write access to the temporary tree. The scope may change (S:C) if the cleanup process operates with higher privileges than the attacker. Without an official vector, we do not assign specific subscores. The blast radius is limited to systems where untrusted users can write to temporary directories cleaned up by privileged processes. Multi-tenant systems, shared hosting, and containers with shared temporary volumes are at higher risk.

Detection Guidance

Sigma Rule

title: Potential Symlink Race in TemporaryDirectory Cleanup
id: 8f9a2b1c-4d3e-4f5a-9b8c-1d2e3f4a5b6c
status: experimental
description: Detects creation of symbolic links in temporary directories that may indicate an attempt to exploit CVE-2026-12345.
author: Threat Intelligence
date: 2026-01-01
logsource:
    product: linux
    service: auditd
detection:
    selection_symlink:
        type: 'SYSCALL'
        syscall: 'symlink'
    selection_path:
        name|startswith:
            - '/tmp/'
            - '/var/tmp/'
    condition: selection_symlink and selection_path
fields:
    - exe
    - name
    - comm
falsepositives:
    - Legitimate applications creating symlinks in temporary directories
level: low
tags:
    - attack.t1190
    - cwe.59

YARA Rule

rule CVE_2026_12345_Symlink_Race
{
    meta:
        description = "Detects scripts or binaries that attempt to manipulate temporary directories with symlinks"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-12345"
        severity = "medium"

    strings:
        $s1 = "tempfile.TemporaryDirectory" ascii wide nocase
        $s2 = "shutil.rmtree" ascii wide nocase
        $s3 = "avoids_symlink_attacks" ascii wide nocase
        $s4 = "os.symlink" ascii wide nocase

    condition:
        any of ($s*) and filesize < 1MB
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-12345 Possible Symlink Race Exploit - Temporary Directory Manipulation"; flow:to_server,established; content:"|2f 74 6d 70|"; content:"|73 79 6d 6c 69 6e 6b|"; distance:0; within:100; sid:10000001; rev:1;)

Elastic Detection

process where event.type == "start" and process.name in ("ln", "symlink", "python", "python3") and process.args : "/tmp/*" and process.args : "symlink"

Splunk SPL Query

index=linux_auditd type=SYSCALL syscall=symlink name="/tmp/*" OR name="/var/tmp/*"
| stats count by host, exe, name, comm
| where count > 0

Wazuh OSSEC Rule

<group name="cve-2026-12345,">
  <rule id="100001" level="5">
    <if_sid>80700</if_sid>
    <field name="syscall">symlink</field>
    <field name="name">/tmp/</field>
    <description>CVE-2026-12345: Potential symlink creation in temporary directory (possible race condition exploit)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Ensure that temporary directories used by privileged processes are created with restrictive permissions (e.g., mode 0700) and are owned by the process user, preventing untrusted users from writing to them.
   • Avoid using world-writable shared temporary directories for privileged operations. Use per-user or per-process private temporary directories.
   • On platforms where shutil.rmtree.avoids_symlink_attacks is false, consider implementing custom cleanup logic that does not follow symlinks (e.g., using os.scandir with follow_symlinks=False and os.unlink/os.rmdir on the entry itself).
   • Monitor for symlink creation in temporary directories by unprivileged users.

2. Patch/upgrade steps:

   • No official patch is available. Monitor Python security advisories and the CPython repository for updates.
   • When a patch is released, upgrade to the patched Python version. If using a distribution-provided Python, apply the distribution's security update.

3. Long-term hardening:

   • Adopt the principle of least privilege for processes that perform cleanup of temporary directories.
   • Use sandboxing or containers to isolate temporary directory operations.
   • Implement file integrity monitoring on critical system files to detect unauthorized deletions or permission changes.
   • Review all uses of tempfile.TemporaryDirectory in privileged code paths and consider replacing with more secure alternatives if available.

References

1. NVD — CVE-2026-12345: https://nvd.nist.gov/vuln/detail/CVE-2026-12345
2. CWE-59: Improper Link Resolution Before File Access ('Link Following'): https://cwe.mitre.org/data/definitions/59.html
3. Python tempfile documentation: https://docs.python.org/3/library/tempfile.html
4. Python shutil.rmtree documentation: https://docs.python.org/3/library/shutil.html#shutil.rmtree
5. CISA Known Exploited Vulnerabilities Catalog (not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are available for this CVE.