GCVE-1988-2026-0073
Vulnerability from gna-1988 β Published: 2026-09-07 13:20 β Updated: 2026-09-07 13:20
VLAI
EPSS
VEX
Title
Chronicle Wire v2026.8 FileMarshallableOut Append Operations Follow Symbolic Links and Allow File Write Redirection
Summary
Chronicle Wire's FileMarshallableOut follows symbolic links when writing
files in append mode. When ?append=true is enabled, the implementation
opens the supplied output path directly using FileOutputStream(path, true)
without preventing symbolic-link resolution.
If an attacker can create or replace the expected output file with a
symbolic link before the append operation occurs, the operating system
resolves the link and Chronicle Wire writes to the link target using the
privileges of the application process.
This can redirect application-generated output from its intended
destination to another file writable by the application.
The proof of concept confirms that an append operation directed at a
symbolic-link path modifies the underlying target file. A separate boundary
test confirms that non-append overwrite mode does not exhibit the same
behavior: the symbolic-link path is replaced while the original target
remains unchanged.
The vulnerability is therefore specifically limited to the append-mode
file-opening path.
Vulnerability Details
FileMarshallableOut determines the destination used for file output based
on whether append mode is enabled:
final String path = url.getPath();
final String path0 = options.append ? path : (path + ".tmp");
When append mode is disabled, Chronicle Wire writes through a temporary
path.
When append mode is enabled, however, path0 directly references the
supplied destination:
path0 = path;
The resulting file is opened using:
try (FileOutputStream out =
new FileOutputStream(path0, options.append)) {
final Bytes<byte[]> bytes =
Jvm.uncheckedCast(wire.bytes());
out.write(
bytes.underlyingObject(),
0,
(int) bytes.readLimit());
}
In append mode, the effective operation is therefore:
new FileOutputStream(path, true);
No protection against symbolic-link resolution is applied when this file is
opened.
If path identifies a symbolic link, normal filesystem resolution causes the
underlying target to be opened and modified.
The existing path validation does not prevent this condition:
String path = url.getPath();
if (path == null ||
path.isEmpty() ||
path.contains(".."))
throw new IllegalArgumentException(
"Invalid file path: " + path);
This prevents certain malformed or traversal-style paths but does not
protect the final destination from symbolic-link substitution.
Root Cause
The append implementation opens the destination using a filesystem
operation that follows symbolic links without enforcing a no-follow policy.
The vulnerability does not require .. traversal or an unusual path syntax.
The apparent destination itself can be a valid filesystem path while
referencing a symbolic link created or substituted by another user or
process.
This creates a security issue when there is a privilege or trust-boundary
difference between the process performing the append operation and the
party capable of manipulating the destination filesystem entry.
For example, a less-privileged attacker may be able to create or replace a
predictable output file within a shared or attacker-writable directory. If
a more privileged application subsequently performs a FileMarshallableOut
append against that path, the resulting write can be redirected to a
different file accessible to the application.
Security Impact
An attacker capable of manipulating the filesystem entry used as an append
destination may redirect Chronicle Wire output to another file writable by
the application's privileges.
Potential consequences depend on the target application's filesystem
permissions and the contents being written.
Affected deployment patterns may include applications writing to:
- shared writable directories;
- predictable temporary locations;
- application export directories;
- CI/CD workspaces;
- shared container volumes;
- cache or working directories;
- plugin-controlled filesystem locations; or
- other locations where a less-privileged party can manipulate
destination entries.
The confirmed security primitive is *file write redirection through
symbolic-link following*.
The proof of concept does not establish arbitrary file overwrite because
the affected operation uses append semantics. The attacker-selected target
must also be writable by the application process.
Proof of Concept
The proof of concept creates an ordinary target file containing:
before
A symbolic link named:
safe-looking-output.yaml
is then created pointing to:
target.txt
Chronicle Wire is instructed to write to safe-looking-output.yaml with
append mode enabled.
The apparent destination is therefore the symbolic-link path, while the
actual filesystem object modified by the operation is target.txt.
Observed Results
The test confirmed the symbolic-link destination and target:
FileMarshallableOut append followed symlink:
/.../safe-looking-output.yaml
FileMarshallableOut symlink target:
/.../target.txt
Before the Chronicle Wire operation, the target contained:
FileMarshallableOut symlink content before BEGIN
before
FileMarshallableOut symlink content before END
The value supplied to FileMarshallableOut was:
FileMarshallableOut symlink value written:
message=symlink-append-proof
After the append operation, the target contained:
FileMarshallableOut symlink content after BEGIN
before
message: symlink-append-proof
...
FileMarshallableOut symlink content after END
The original contents remained and the Chronicle Wire output was appended
directly to the symbolic-link target.
This confirms that FileMarshallableOut followed the symbolic link during
the append operation.
Boundary Validation
Non-append mode was tested separately to determine whether the behavior
affected all FileMarshallableOut file writes.
The original target contained:
before
After performing the non-append operation through the symbolic-link path,
the original target still contained:
before
The test confirmed that non-append processing replaced the symbolic-link
path rather than following the link and modifying its original target.
The demonstrated vulnerability is therefore specifically associated with:
?append=true
and the corresponding:
new FileOutputStream(path, true);
file-opening path.
PoC Results
The security test confirmed the following behavior:
[CONFIRMED] Append destination was a symbolic link[CONFIRMED] Symbolic
link referenced a separate target file[CONFIRMED] Chronicle Wire
opened the apparent destination in append mode[CONFIRMED] Output was
written to the symbolic-link target[CONFIRMED] Original target
contents remained intact[CONFIRMED] Chronicle Wire data was appended
to the target[CONFIRMED] Non-append mode did not modify the original
symlink target
The runtime evidence demonstrates that append-mode output can cross the
apparent filesystem boundary established by the supplied destination path.
Ron Edgerson
Vulnerability Researcher & Exploit Developer
CVE Research | Binary Exploitation | Application & Systems Security
Responsible Disclosure β’ Proof-of-Concept Development
π https://github.com/ob1sec
π https://www.linkedin.com/in/ronedgerson1
<https://linkedin.com/in/yourhandle>
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| unknown | Chronicle Wire |
Affected:
unknown
|
guessed |
{
"containers": {
"cna": {
"affected": [
{
"product": "Chronicle Wire",
"vendor": "unknown",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ron E"
}
],
"descriptions": [
{
"lang": "en",
"value": "Chronicle Wire\u0027s FileMarshallableOut follows symbolic links when writing\nfiles in append mode. When ?append=true is enabled, the implementation\nopens the supplied output path directly using FileOutputStream(path, true)\nwithout preventing symbolic-link resolution.\n\nIf an attacker can create or replace the expected output file with a\nsymbolic link before the append operation occurs, the operating system\nresolves the link and Chronicle Wire writes to the link target using the\nprivileges of the application process.\n\nThis can redirect application-generated output from its intended\ndestination to another file writable by the application.\n\nThe proof of concept confirms that an append operation directed at a\nsymbolic-link path modifies the underlying target file. A separate boundary\ntest confirms that non-append overwrite mode does not exhibit the same\nbehavior: the symbolic-link path is replaced while the original target\nremains unchanged.\n\nThe vulnerability is therefore specifically limited to the append-mode\nfile-opening path.\nVulnerability Details\n\nFileMarshallableOut determines the destination used for file output based\non whether append mode is enabled:\n\nfinal String path = url.getPath();\nfinal String path0 = options.append ? path : (path + \".tmp\");\n\nWhen append mode is disabled, Chronicle Wire writes through a temporary\npath.\n\nWhen append mode is enabled, however, path0 directly references the\nsupplied destination:\n\npath0 = path;\n\nThe resulting file is opened using:\n\ntry (FileOutputStream out =\n new FileOutputStream(path0, options.append)) {\n\n final Bytes\u003cbyte[]\u003e bytes =\n Jvm.uncheckedCast(wire.bytes());\n\n out.write(\n bytes.underlyingObject(),\n 0,\n (int) bytes.readLimit());\n}\n\nIn append mode, the effective operation is therefore:\n\nnew FileOutputStream(path, true);\n\nNo protection against symbolic-link resolution is applied when this file is\nopened.\n\nIf path identifies a symbolic link, normal filesystem resolution causes the\nunderlying target to be opened and modified.\n\nThe existing path validation does not prevent this condition:\n\nString path = url.getPath();\n\nif (path == null ||\n path.isEmpty() ||\n path.contains(\"..\"))\n throw new IllegalArgumentException(\n \"Invalid file path: \" + path);\n\nThis prevents certain malformed or traversal-style paths but does not\nprotect the final destination from symbolic-link substitution.\nRoot Cause\n\nThe append implementation opens the destination using a filesystem\noperation that follows symbolic links without enforcing a no-follow policy.\n\nThe vulnerability does not require .. traversal or an unusual path syntax.\nThe apparent destination itself can be a valid filesystem path while\nreferencing a symbolic link created or substituted by another user or\nprocess.\n\nThis creates a security issue when there is a privilege or trust-boundary\ndifference between the process performing the append operation and the\nparty capable of manipulating the destination filesystem entry.\n\nFor example, a less-privileged attacker may be able to create or replace a\npredictable output file within a shared or attacker-writable directory. If\na more privileged application subsequently performs a FileMarshallableOut\nappend against that path, the resulting write can be redirected to a\ndifferent file accessible to the application.\nSecurity Impact\n\nAn attacker capable of manipulating the filesystem entry used as an append\ndestination may redirect Chronicle Wire output to another file writable by\nthe application\u0027s privileges.\n\nPotential consequences depend on the target application\u0027s filesystem\npermissions and the contents being written.\n\nAffected deployment patterns may include applications writing to:\n\n - shared writable directories;\n - predictable temporary locations;\n - application export directories;\n - CI/CD workspaces;\n - shared container volumes;\n - cache or working directories;\n - plugin-controlled filesystem locations; or\n - other locations where a less-privileged party can manipulate\n destination entries.\n\nThe confirmed security primitive is *file write redirection through\nsymbolic-link following*.\n\nThe proof of concept does not establish arbitrary file overwrite because\nthe affected operation uses append semantics. The attacker-selected target\nmust also be writable by the application process.\nProof of Concept\n\nThe proof of concept creates an ordinary target file containing:\n\nbefore\n\nA symbolic link named:\n\nsafe-looking-output.yaml\n\nis then created pointing to:\n\ntarget.txt\n\nChronicle Wire is instructed to write to safe-looking-output.yaml with\nappend mode enabled.\n\nThe apparent destination is therefore the symbolic-link path, while the\nactual filesystem object modified by the operation is target.txt.\nObserved Results\n\nThe test confirmed the symbolic-link destination and target:\n\nFileMarshallableOut append followed symlink:\n/.../safe-looking-output.yaml\n\nFileMarshallableOut symlink target:\n/.../target.txt\n\nBefore the Chronicle Wire operation, the target contained:\n\nFileMarshallableOut symlink content before BEGIN\nbefore\nFileMarshallableOut symlink content before END\n\nThe value supplied to FileMarshallableOut was:\n\nFileMarshallableOut symlink value written:\nmessage=symlink-append-proof\n\nAfter the append operation, the target contained:\n\nFileMarshallableOut symlink content after BEGIN\nbefore\nmessage: symlink-append-proof\n...\nFileMarshallableOut symlink content after END\n\nThe original contents remained and the Chronicle Wire output was appended\ndirectly to the symbolic-link target.\n\nThis confirms that FileMarshallableOut followed the symbolic link during\nthe append operation.\nBoundary Validation\n\nNon-append mode was tested separately to determine whether the behavior\naffected all FileMarshallableOut file writes.\n\nThe original target contained:\n\nbefore\n\nAfter performing the non-append operation through the symbolic-link path,\nthe original target still contained:\n\nbefore\n\nThe test confirmed that non-append processing replaced the symbolic-link\npath rather than following the link and modifying its original target.\n\nThe demonstrated vulnerability is therefore specifically associated with:\n\n?append=true\n\nand the corresponding:\n\nnew FileOutputStream(path, true);\n\nfile-opening path.\nPoC Results\n\nThe security test confirmed the following behavior:\n\n[CONFIRMED] Append destination was a symbolic link[CONFIRMED] Symbolic\nlink referenced a separate target file[CONFIRMED] Chronicle Wire\nopened the apparent destination in append mode[CONFIRMED] Output was\nwritten to the symbolic-link target[CONFIRMED] Original target\ncontents remained intact[CONFIRMED] Chronicle Wire data was appended\nto the target[CONFIRMED] Non-append mode did not modify the original\nsymlink target\n\nThe runtime evidence demonstrates that append-mode output can cross the\napparent filesystem boundary established by the supplied destination path.\n\nRon Edgerson\nVulnerability Researcher \u0026 Exploit Developer\n\nCVE Research | Binary Exploitation | Application \u0026 Systems Security\nResponsible Disclosure \u2022 Proof-of-Concept Development\n\n\ud83c\udf10 https://github.com/ob1sec\n\ud83d\udd17 https://www.linkedin.com/in/ronedgerson1\n\u003chttps://linkedin.com/in/yourhandle\u003e\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-07T13:20:21Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/83"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/83"
},
{
"url": "https://github.com/ob1sec"
},
{
"url": "https://linkedin.com/in/yourhandle"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.linkedin.com/in/ronedgerson1"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/83"
],
"discovery": "EXTERNAL"
},
"title": "Chronicle Wire v2026.8 FileMarshallableOut Append Operations Follow Symbolic Links and Allow File Write Redirection",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0073",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/83",
"automated": true,
"contentSha256": "5de50e3c1671bae7dda757a3dc128e36b921139464af78fca0496bf95f07f08c",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/83",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-22T12:41:27Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-09-07T13:20:21Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0073"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loadingβ¦
Loadingβ¦
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loadingβ¦
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loadingβ¦
Loadingβ¦