glibc gettext allows directory traversal via LANGUAGE
Original title: The GNU C Library security advisories update for 2026-10-30
The issue affects GNU C Library 2.0 and later, except setuid or setgid programs marked AT_SECURE.
The GNU C Library project published GLIBC-SA-2026-0025 on October 30. gettext functions in version 2.0 and later accept LANGUAGE entries containing "/" or equal to "..", unless the program is setuid or setgid (AT_SECURE). An attacker who can set LANGUAGE can cause directory traversal. The posted text ends before stating the full impact or a fix.
Unconfirmed: The notice is cut off, so the full impact and any fixed version are not stated.
- The advisory identifier is GLIBC-SA-2026-0025.
- It was posted by Adhemerval Zanella Netto on October 30.
- Only the gettext family of functions is named as affected.
- No fixed version is given in the available text.
Impact: directory traversal through the LANGUAGE environment variable
| Product | Affected |
|---|---|
| GNU C Library | 2.0 and later |
- Vendors
- GNU
- Products
- GNU C Library
From the original article
Posted by Adhemerval Zanella Netto on Oct 30 The following security advisories have been published: GLIBC-SA-2026-0025: =================== gettext: Directory traversal via the LANGUAGE environment variable The gettext family of functions in the GNU C Library version 2. 0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to ".."
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.