View Issue Details

Jump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0002423XdebugUncategorizedpublic2026-05-20 00:122026-06-08 14:36
Reporterilia Assigned To 
PrioritynormalSeverityminorReproducibilityalways
Status closedResolutionfixed 
Product Version3.5.1 
Target Version3.5devFixed in Version3.5.3 
Summary0002423: Don't follow symlinks with file creation
Description

xdebug_fopen opens the trace/profile/gcstats file with stat() + fopen("r+") + flock(LOCK_EX) + freopen("w"). All three follow symlinks. No O_NOFOLLOW.
A user with write access to xdebug.output_dir (default /tmp) pre-places a symlink at the predictable tmp_fname pointing at any file writable by the PHP process.freopen("w") truncates and overwrites.

Fix: lstat() instead of stat(); on S_ISLNK, route through xdebug_open_file_with_random_ext

Steps To Reproduce
  1. echo "ORIGINAL_SECRET" > /tmp/xd005b-victim
  2. mkdir /tmp/xd005b-out && ln -s /tmp/xd005b-victim /tmp/xd005b-out/attack.xt.gz
  3. Run PHP CLI with xdebug.mode=trace, xdebug.output_dir=/tmp/xd005b-out, xdebug.trace_output_name=attack.
  4. /tmp/xd005b-victim now contains gzipped xdebug trace data.
TagsNo tags attached.
Operating System
PHP Version8.5.0-8.5.4

Activities

derick

2026-05-27 17:06

administrator   ~0007501

https://github.com/xdebug/xdebug/pull/1082