GHSA-hpfw-mqm3-33jh CVE-2026-35359
uutils coreutils has a Link Following issue
- Severity
- 4.7 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.13%
- Chance of exploitation in the next 30 days. Higher than 2.30% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
- Fix
- None yet
- No fixed version published
Description
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| coreutils | <= 0.8.0 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 4.7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Local
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-59: Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
How to prevent it
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-m2pg-c7m6-77pj uutils coreutils has an Improper Input Validation Issue in its cut Utility | Medium | Also affects coreutils |
| GHSA-fhr3-xh3q-69w6 uutils coreutils has an Incorrect Provision of Specified Functionality Issue | Low | Also affects coreutils |
| GHSA-5pv5-xh52-hvrp uutils coreutils has an Incorrect Short Circuit Evaluation Issue | Low | Also affects coreutils |
| GHSA-5v4g-vw9x-h534 uutils coreutils has an Improper Input Validation Issue in its env Utility | Low | Also affects coreutils |
| GHSA-6g8r-74qp-6859 uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition | Medium | Also affects coreutils |
| GHSA-vx9m-xjwf-8cqm uutils coreutils has an Improper Handling of Unicode Encoding Issue | Low | Also affects coreutils |
| GHSA-4wrp-79m8-9m9p uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition | Medium | Also affects coreutils |
| GHSA-wq63-vh5h-pr5p uutils coreutils has a UNIX Symbolic Link (Symlink) Following issue | Medium | Also affects coreutils |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor