Re: [PATCH v3] intl: Restrict path traversal when using LANGUAGE env var [BZ #17142, CVE-2026-84243]

Florian Weimer <[email protected]> Tue, 01 Sep 2026 16:01:22 +0200

Newsgroups	gmane.comp.lib.glibc.alpha
Message-ID	<[email protected]>

* Avinal Kumar:

> diff --git a/intl/dcigettext.c b/intl/dcigettext.c
> index 43b99c2dea..e9611dae7a 100644
> --- a/intl/dcigettext.c
> +++ b/intl/dcigettext.c
> @@ -591,10 +591,10 @@ DCIGETTEXT (const char *domainname, const char *msgid1, const char *msgid2,
>  	    *cp++ = *categoryvalue++;
>  	  *cp = '\0';
>  
> -	  /* When this is a SUID binary we must not allow accessing files
> -	     outside the dedicated directories.  */
> -	  if (ENABLE_SECURE && IS_PATH_WITH_DIR (single_locale))
> -	    /* Ignore this entry.  */
> +	  /* Do not allow accessing files outside the dedicated
> +	     directories.  */
> +	  if (IS_PATH_WITH_DIR (single_locale)
> +	      || strcmp (single_locale, "..") == 0)
>  	    continue;
>  	}
>  

Is there an impact on SUID binaries because ".." was not skipped before?

Thanks,
Florian