CVE-2026-35362

LowCVSS 3.6/10Last modified Oct 26, 2026

Description

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Metrics

CVSS 3.1 3.6/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-367

Affected software

Vendor	Product	Versions
Uutils	coreutils	< 0.6.0

References

https://github.com/uutils/coreutils/pull/9792Issue Tracking, Patch
https://github.com/uutils/coreutils/releases/tag/0.6.0Release Notes

Timeline

Published: Apr 22, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-353635.6A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. W CVE-2026-353646.3A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The util CVE-2026-353656.6The mv utility in uutils coreutils improperly handles directory trees containing symbolic links during moves across filesystem boundaries. I CVE-2026-353664.4The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits CVE-2026-353673.3The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This c CVE-2026-353687.8A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specificati CVE-2026-353695.5An argument parsing error in the kill utility of uutils coreutils incorrectly interprets kill -1 as a request to send the default signal (SI CVE-2026-35378.8Object lifecycle issue in PowerVR in Google Chrome on Android prior to 145.0.7632.159 allowed a remote attacker to potentially exploit heap CVE-2026-353704.4The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of the CVE-2026-353713.3The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The CVE-2026-353725.0A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target even when the --no-dereference CVE-2026-353735.5A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using