CVE-2026-35345

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35345", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "state": "PUBLISHED", "assignerShortName": "canonical", "dateReserved": "2026-04-02T12:58:56.087Z", "datePublished": "2026-04-22T16:07:49.191Z", "dateUpdated": "2026-04-22T18:13:19.881Z"}, "containers": {"cna": {"title": "uutils coreutils tail Privileged Information Disclosure via Symlink Replacement Race", "affected": [{"vendor": "Uutils", "product": "coreutils", "platforms": ["Linux", "Unix", "macOS"], "collectionURL": "https://github.com/uutils", "packageName": "coreutils", "repo": "https://github.com/uutils/coreutils", "defaultStatus": "affected"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-367", "description": "CWE-367: Time-of-Check Time-of-Use (TOCTOU) Race Condition", "type": "CWE"}, {"lang": "en", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-27", "descriptions": [{"lang": "en", "value": "CAPEC-27: Leveraging Race Conditions via Symbolic Links"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link's target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file."}], "references": [{"url": "https://github.com/uutils/coreutils/issues/10328", "tags": ["issue-tracking"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N"}}], "credits": [{"lang": "en", "value": "Zellic", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-04-22T16:07:49.191Z"}}, "adp": [{"references": [{"url": "https://github.com/uutils/coreutils/issues/10328", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T18:13:16.337487Z", "id": "CVE-2026-35345", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T18:13:19.881Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35345", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T18:13:16.337487Z"}}}], "references": [{"url": "https://github.com/uutils/coreutils/issues/10328", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T18:12:52.165Z"}}], "cna": {"title": "uutils coreutils tail Privileged Information Disclosure via Symlink Replacement Race", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Zellic"}], "impacts": [{"capecId": "CAPEC-27", "descriptions": [{"lang": "en", "value": "CAPEC-27: Leveraging Race Conditions via Symbolic Links"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/uutils/coreutils", "vendor": "Uutils", "product": "coreutils", "platforms": ["Linux", "Unix", "macOS"], "packageName": "coreutils", "collectionURL": "https://github.com/uutils", "defaultStatus": "affected"}], "references": [{"url": "https://github.com/uutils/coreutils/issues/10328", "tags": ["issue-tracking"]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link's target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-367", "description": "CWE-367: Time-of-Check Time-of-Use (TOCTOU) Race Condition"}, {"lang": "en", "type": "CWE", "cweId": "CWE-59", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')"}]}], "providerMetadata": {"orgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "shortName": "canonical", "dateUpdated": "2026-04-22T16:07:49.191Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35345", "state": "PUBLISHED", "dateUpdated": "2026-04-22T18:13:19.881Z", "dateReserved": "2026-04-02T12:58:56.087Z", "assignerOrgId": "cc1ad9ee-3454-478d-9317-d3e869d708bc", "datePublished": "2026-04-22T16:07:49.191Z", "assignerShortName": "canonical"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/uutils", "defaultStatus": "affected", "packageName": "coreutils", "platforms": ["Linux", "Unix", "macOS"], "product": "coreutils", "repo": "https://github.com/uutils/coreutils", "vendor": "Uutils"}], "source": "security@ubuntu.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*", "matchCriteriaId": "4A9AF9E4-E17C-48AD-8051-B49998618839", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link's target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file."}, {"lang": "es", "value": "Una vulnerabilidad en la utilidad tail de uutils coreutils permite la exfiltraci\u00f3n de contenidos de archivos sensibles al usar la opci\u00f3n --follow=name. A diferencia de GNU tail, la implementaci\u00f3n de uutils contin\u00faa monitorizando una ruta despu\u00e9s de que ha sido reemplazada por un enlace simb\u00f3lico, mostrando posteriormente los contenidos del objetivo del enlace. En entornos donde un usuario privilegiado (p. ej., root) monitoriza un directorio de registros, un atacante local con acceso de escritura a ese directorio puede reemplazar un archivo de registro con un enlace simb\u00f3lico a un archivo de sistema sensible (como /etc/sha4dow), haciendo que tail divulgue los contenidos del archivo sensible."}], "id": "CVE-2026-35345", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 4.2, "source": "security@ubuntu.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35345", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T18:13:16.337487Z", "version": "2.0.3"}}]}, "published": "2026-04-22T17:16:36.627", "references": [{"source": "security@ubuntu.com", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/uutils/coreutils/issues/10328"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Issue Tracking"], "url": "https://github.com/uutils/coreutils/issues/10328"}], "sourceIdentifier": "security@ubuntu.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}, {"lang": "en", "value": "CWE-367"}], "source": "security@ubuntu.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["linux", "unix", "macos"], "status": "affected", "versions": null}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "coreutils", "source": "cna", "vendor": "Uutils"}, "product": "coreutils", "vendor": "uutils"}], "analysis": {"en": {"generated_at": "2026-04-22T18:15:58.568688+00:00", "value": {"mitigation_remediation": ["Update to the latest version of uutils coreutils where the race condition is fixed.", "Restrict write permissions on log directories that are monitored by tail so that only trusted users can alter files in those paths.", "Avoid using the --follow=name option with privileged instances of tail; instead use safer monitoring methods or disable the option entirely."], "summary": {"action": "Apply Patch", "impact": "Information Disclosure via Symlink Race"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the tail command distributed by the Uutils coreutils project. No specific affected versions are disclosed. Anyone using uutils coreutils and running tail with the --follow=name flag in a privileged context is potentially impacted.", "description_and_impact": "A flaw in the uutils coreutils tail utility causes information disclosure when the --follow=name option is used. The tool keeps monitoring a file path even after it is replaced by a symbolic link. Consequently, if an attacker replaces a log file with a symlink to a protected file such as /etc/shadow, tail will output the contents of that file. This allows a local attacker who can write to the monitored directory to exfiltrate sensitive data that otherwise would require privileged access.", "risk_and_exploitability": "The CVSS score of 5.3 reflects a moderate risk. EPSS information is not available, so the likely exploitation probability cannot be quantified, but the flaw remains unlisted in CISA KEV catalog. The attack requires local write access to a directory that is monitored by a privileged tail instance. Once those conditions exist, the attacker can create a symlink to a sensitive file and trigger data disclosure. The risk is heightened when the victim runs tail as a privileged user monitoring log directories of sensitive system files."}}}}, "created": "2026-04-22T18:30:23.750421+00:00", "updated": "2026-04-27T19:54:41.739110+00:00", "vendors": ["uutils", "uutils$PRODUCT$coreutils"]}