What’s Vulnerable › Vulnerabilities

CVE-2026-35356: uutils coreutils install Arbitrary File Overwrite with -D via Path Component Symlink Race

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-22 · updated 2026-10-26
• Weakness: CWE-367

Description

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command creates parent directories and subsequently performs a second path resolution to create the target file, neither of which is anchored to a directory file descriptor. An attacker with concurrent write access can replace a path component with a symbolic link between these operations, redirecting the privileged write to an arbitrary file system location.

Affected products

• Uutils coreutils: before 0.7.0 — fixed in 0.7.0

How to fix

Upgrade to a fixed version: Uutils coreutils 0.7.0. Check the vendor advisory for mitigations.

References

• https://github.com/uutils/coreutils/pull/10140
• https://github.com/uutils/coreutils/releases/tag/0.7.0

Get alerted when CVE-2026-35356 or the next vulnerability affects your stack