CVE-2026-58015

Published: Jun 30, 2026Modified: Jul 2, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.

Affected (6)

Products: Gnome: Glib · Redhat: Enterprise Linux

1 product

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gnome Glib	Before 2.88.1
Redhat Enterprise Linux	Version 10.0
Redhat Enterprise Linux	Version 6.0
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux	Version 9.0

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (3)

https://access.redhat.com/security/cve/CVE-2026-58015

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2492256

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://gitlab.gnome.org/GNOME/glib/-/issues/3931

Source: secalert@redhat.com

ExploitIssue TrackingVendor Advisory

Timeline

No history available yet.