A flaw in Samba’s vfs_worm module allows an authenticated user with write access to a share to overwrite a protected file by renaming a new file over the existing WORM-protected file due to insufficient validation of rename operations. This undermines the core purpose of WORM protection, which is to enforce file immutability after a grace period, and exposes the system to intentional data tampering and loss of compliance guarantees. The weakness is classified as CWE‑280, reflecting improper access control over file modifications.

The vulnerability affects Red Hat Enterprise Linux releases 6, 7, 8, 9, 10 and Red Hat OpenShift Container Platform 4. All instances that run the affected Samba version on these platforms are susceptible unless protected files are otherwise secured at the filesystem level.

With a CVSS score of 6.5 the vulnerability is considered medium severity. EPSS information is not available, and the flaw is not listed in the CISA KEV catalog, indicating no known active exploitation campaigns at this time. Nonetheless, the attack requires local or network authentication with standard write access to a Samba share, a configuration that is common in many environments. An attacker who meets these prerequisites can overwrite WORM‑protected files, potentially compromising critical archival data and regulatory compliance.