CVE-2026-35339

MediumCVSS 5.5/10Last modified Oct 26, 2026

Description

The recursive mode (-R) of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple files. The final return value is determined solely by the success or failure of the last file processed. This allows the command to return an exit code of 0 (success) even if errors were encountered on previous files, such as 'Operation not permitted'. Scripts relying on these exit codes may proceed under a false sense of success while sensitive files remain with restrictive or incorrect permissions.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-253

Affected software

Vendor	Product	Versions
Uutils	coreutils	< 0.6.0

References

https://github.com/uutils/coreutils/pull/9793Issue Tracking, Patch
https://github.com/uutils/coreutils/releases/tag/0.6.0Release Notes

Timeline

Published: Apr 22, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-35346.4The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `ast-page-background-meta` and `ast-content-background-me CVE-2026-353405.5A flaw in the ChownExecutor used by uutils coreutils chown and chgrp causes the utilities to return an incorrect exit code during recursive CVE-2026-353417.1A vulnerability in uutils coreutils mkfifo allows for the unauthorized modification of permissions on existing files. When mkfifo fails to c CVE-2026-353423.3The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to CVE-2026-353433.3The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimite CVE-2026-353443.3The dd utility in uutils coreutils suppresses errors during file truncation operations by unconditionally calling Result::ok() on truncation CVE-2026-353455.3A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name CVE-2026-353463.3The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation use CVE-2026-353474.4The comm utility in uutils coreutils incorrectly consumes data from non-regular file inputs before performing comparison operations. The are CVE-2026-353485.5The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 f CVE-2026-353497.7A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. The implementation uses a path-stri CVE-2026-35359.8The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the `DSGV