GHSA-wq63-vh5h-pr5p CVE-2026-35372
uutils coreutils has a UNIX Symbolic Link (Symlink) Following issue
- Severity
- 5.0 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.14%
- Chance of exploitation in the next 30 days. Higher than 3.21% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-61 UNIX Symbolic Link (Symlink) Following
- Fix
0.8.0- Upgrade coreutils to this version or later
Description
A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target even when the --no-dereference (or -n) flag is explicitly provided. The implementation previously only honored the "no-dereference" intent if the --force (overwrite) mode was also enabled. This flaw causes ln to follow a symbolic link that points to a directory and create new links inside that target directory instead of treating the symbolic link itself as the destination. In environments where a privileged user or system script uses ln -n to update a symlink, a local attacker could manipulate existing symbolic links to redirect file creation into sensitive directories, potentially leading to unauthorized file creation or system misconfiguration.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| coreutils | < 0.8.0 |
0.8.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
coreutils crates.io → 0.8.0
- cargo
cargo update -p coreutils --precise 0.8.0
Severity breakdown
CVSS 3.1 5.0
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-61: UNIX Symbolic Link (Symlink) Following
The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files.
How to prevent it
- Implementation: Symbolic link attacks often occur when a program creates a tmp directory that stores files/links. Access to the directory should be restricted to the program as to prevent attackers from manipulating the files.
- Architecture and Design: Follow the principle of least privilege when assigning access rights to entities in a software system. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-m2pg-c7m6-77pj uutils coreutils has an Improper Input Validation Issue in its cut Utility | Medium | Also affects coreutils |
| GHSA-fhr3-xh3q-69w6 uutils coreutils has an Incorrect Provision of Specified Functionality Issue | Low | Also affects coreutils |
| GHSA-5pv5-xh52-hvrp uutils coreutils has an Incorrect Short Circuit Evaluation Issue | Low | Also affects coreutils |
| GHSA-5v4g-vw9x-h534 uutils coreutils has an Improper Input Validation Issue in its env Utility | Low | Also affects coreutils |
| GHSA-6g8r-74qp-6859 uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition | Medium | Also affects coreutils |
| GHSA-vx9m-xjwf-8cqm uutils coreutils has an Improper Handling of Unicode Encoding Issue | Low | Also affects coreutils |
| GHSA-4wrp-79m8-9m9p uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition | Medium | Also affects coreutils |
| GHSA-mh5c-xrmh-m794 uutils coreutils has an Untrusted Search Path | High | Also affects coreutils |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor