---
id: CVE-2021-28153
title: An issue was discovered in GNOME GLib before 2.66.8
summary: >-
  An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is
  used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a
  dangling symlink, it incorrectly also creates the target of the symlink as an
  empty fil…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-59
vendor: gnome
product: glib
affected:
  - glib < 2.66.8
  - brocade_fabric_operating_system_firmware
  - debian_linux = 9.0
  - fedora = 33
patched:
  - glib 2.66.8
published: '2021-03-11'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T12:17:10.900'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-28153'
references:
  - url: 'https://gitlab.gnome.org/GNOME/glib/-/issues/2325'
    label: cve@mitre.org
  - url: 'https://lists.debian.org/debian-lts-announce/2022/06/msg00006.html'
    label: cve@mitre.org
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RXTD5HCP2K4AAUSWWZTBKQNHRCTAEOF/
    label: cve@mitre.org
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICUTQPHZNZWX2DZR46QFLQZRHVMHIILJ/
    label: cve@mitre.org
  - url: 'https://security.gentoo.org/glsa/202107-13'
    label: cve@mitre.org
  - url: 'https://security.netapp.com/advisory/ntap-20210416-0003/'
    label: cve@mitre.org
  - url: 'https://gitlab.gnome.org/GNOME/glib/-/issues/2325'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2022/06/msg00006.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6RXTD5HCP2K4AAUSWWZTBKQNHRCTAEOF/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ICUTQPHZNZWX2DZR46QFLQZRHVMHIILJ/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.gentoo.org/glsa/202107-13'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20210416-0003/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.02622
epssPercentile: 0.85091
ingestedAt: '2026-10-14T12:29:10.817Z'
---

## Overview

An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.)

## Affected

- `glib < 2.66.8`
- `brocade_fabric_operating_system_firmware`
- `debian_linux = 9.0`
- `fedora = 33`

## Remediation

Upgrade past the affected range:

- `glib 2.66.8`