What’s Vulnerable › Vulnerabilities

CVE-2026-35362: uutils coreutils Missing TOCTOU Protection on Non-Linux Unix Platforms in Safe Traversal Module

• Severity: low (CVSS 3.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-22 · updated 2026-10-26
• Weakness: CWE-367

Description

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Affected products

• Uutils coreutils: before 0.6.0 — fixed in 0.6.0

How to fix

Upgrade to a fixed version: Uutils coreutils 0.6.0. Check the vendor advisory for mitigations.

References

• https://github.com/uutils/coreutils/pull/9792
• https://github.com/uutils/coreutils/releases/tag/0.6.0

Get alerted when CVE-2026-35362 or the next vulnerability affects your stack