GHSA-957r-r8gc-vv3h CVE-2026-35351
uutils coreutils doesn't preserve file ownership during moves across different filesystem boundaries
- Severity
- 4.2 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.13%
- Chance of exploitation in the next 30 days. Higher than 2.74% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-281 Improper Preservation of Permissions
- Fix
- None yet
- No fixed version published
Description
The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| coreutils | <= 0.8.0 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 4.2
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- High
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Weakness
CWE-281: Improper Preservation of Permissions
The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-m2pg-c7m6-77pj uutils coreutils has an Improper Input Validation Issue in its cut Utility | Medium | Also affects coreutils |
| GHSA-fhr3-xh3q-69w6 uutils coreutils has an Incorrect Provision of Specified Functionality Issue | Low | Also affects coreutils |
| GHSA-5pv5-xh52-hvrp uutils coreutils has an Incorrect Short Circuit Evaluation Issue | Low | Also affects coreutils |
| GHSA-5v4g-vw9x-h534 uutils coreutils has an Improper Input Validation Issue in its env Utility | Low | Also affects coreutils |
| GHSA-6g8r-74qp-6859 uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition | Medium | Also affects coreutils |
| GHSA-vx9m-xjwf-8cqm uutils coreutils has an Improper Handling of Unicode Encoding Issue | Low | Also affects coreutils |
| GHSA-4wrp-79m8-9m9p uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition | Medium | Also affects coreutils |
| GHSA-wq63-vh5h-pr5p uutils coreutils has a UNIX Symbolic Link (Symlink) Following issue | Medium | Also affects coreutils |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor