CVE-2026-35356

MEDIUM6.3EPSS 0.01%

uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition

Published: 4/22/2026Modified: 5/5/2026
Also known as:GHSA-m26v-hjq3-x245DEBIAN-CVE-2026-35356

Description

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command creates parent directories and subsequently performs a second path resolution to create the target file, neither of which is anchored to a directory file descriptor. An attacker with concurrent write access can replace a path component with a symbolic link between these operations, redirecting the privileged write to an arbitrary file system location.

Affected packages (2)

CVSS scores

SourceVersionSeverityVector
osvCVSS 3.1MEDIUM6.3CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

References (6)