CVE-2021-28153

An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)

CVSS 3.1

5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

2.7% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-25)

CWE

CWE-59

Published

2021-03-11

Modified

2026-10-14

Record from

the NVD, synced 2026-10-19

Affected

• broadcom:brocade_fabric_operating_system_firmware
• debian:debian_linux
• fedoraproject:fedora
• gnome:glib

References

• https://gitlab.gnome.org/GNOME/glib/-/issues/2325
• https://lists.debian.org/debian-lts-announce/2022/06/msg00006.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RXTD5HCP2K4AAUSWWZTBKQNHRCTAEOF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICUTQPHZNZWX2DZR46QFLQZRHVMHIILJ/
• https://security.gentoo.org/glsa/202107-13

Check your stackJSON