What’s Vulnerable › Vulnerabilities

CVE-2026-35355: uutils coreutils install Arbitrary File Overwrite via Symlink TOCTOU Race

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-22 · updated 2026-10-26
• Weakness: CWE-367

Description

The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation. The implementation unlinks an existing destination file and then recreates it using a path-based operation without the O_EXCL flag. A local attacker can exploit the window between the unlink and the subsequent creation to swap the path with a symbolic link, allowing them to redirect privileged writes to overwrite arbitrary system files.

Affected products

• Uutils coreutils: before 0.6.0 — fixed in 0.6.0

How to fix

Upgrade to a fixed version: Uutils coreutils 0.6.0. Check the vendor advisory for mitigations.

References

• https://github.com/uutils/coreutils/pull/10067
• https://github.com/uutils/coreutils/releases/tag/0.6.0
• https://github.com/uutils/coreutils/pull/10067

Get alerted when CVE-2026-35355 or the next vulnerability affects your stack