CVE-2026-35356

MEDIUM EPSS 1.4%
Published Apr 22, 20262mo ago · Modified Jun 17, 20261w ago
6.3 CVSS 3.1
Medium
Find Similar
Published Apr 22, 2026 2mo ago
Last Modified Jun 17, 2026 1w ago

Description

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command creates parent directories and subsequently performs a second path resolution to create the target file, neither of which is anchored to a directory file descriptor. An attacker with concurrent write access can replace a path component with a symbolic link between these operations, redirecting the privileged write to an arbitrary file system location.

CVSS Details

Base Score
6.3
Exploitability
1.0
Impact
5.2
Vector string
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack Vector Local
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
1.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-367

Affected Products 1

VendorProductVersionRange
uutilscoreutils* <0.7.0

References 2

  • github.com https://github.com/uutils/coreutils/pull/10140
    Issue TrackingPatch
  • github.com https://github.com/uutils/coreutils/releases/tag/0.7.0
    Release Notes

Remediation

  • github.com https://github.com/uutils/coreutils/pull/10140
    Issue TrackingPatch