Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 45

Export CSV
CVE-2026-35357

uutils coreutils cp Information Disclosure via Permission Handling Race

The cp utility in uutils coreutils is vulnerable to an information disclosure race condition. Destination files are initially created with umask-derived permissions (e.g., 0644) before being restricted to their final mode (e.g., 0600) later in the process. A local attacker can race to open the file during this window; once obtained, the file descriptor remains valid and readable even after the permissions are tightened, exposing sensitive or private file contents.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Uutils
Products
Coreutils
CVE-2026-35359

uutils coreutils cp Information Disclosure via Time-of-Check to Time-of-Use Symlink Swap

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Uutils
Products
Coreutils
CVE-2026-35360

uutils coreutils touch Arbitrary File Truncation via TOCTOU Race Condition

The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the utility identifies a missing path, it later attempts creation using File::create(), which internally uses O_TRUNC. An attacker can exploit this window to create a file or swap a symlink at the target path, causing touch to truncate an existing file and leading to permanent data loss.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Uutils
Products
Coreutils
CVE-2026-35363

uutils coreutils rm Safeguard Bypass via Improper Path Normalization

A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading 'Invalid input' error, which may cause users to miss the critical window for data recovery.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Uutils
Products
Coreutils
CVE-2026-35348

uutils coreutils sort Local Denial of Service via Forced UTF-8 Parsing

The sort utility in uutils coreutils is vulnerable to a process panic when using the --files0-from option with inputs containing non-UTF-8 filenames. The implementation enforces UTF-8 encoding and utilizes expect(), causing an immediate crash when encountering valid but non-UTF-8 paths. This diverges from GNU sort, which treats filenames as raw bytes. A local attacker can exploit this to crash the utility and disrupt automated pipelines.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Uutils
Products
Coreutils