CVE-2026-35338
HIGH7.3EPSS 0.01%uutils coreutils allows users to bypass the --preserve-root safety mechanism
Published: 4/22/2026Modified: 5/5/2026
Also known as:GHSA-9gqx-53gp-c8g3
Description
A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism. The implementation only validates if the target path is literally / and does not canonicalize the path. An attacker or accidental user can use path variants such as /../ or symbolic links to execute destructive recursive operations (e.g., chmod -R 000) on the entire root filesystem, leading to system-wide permission loss and potential complete system breakdown.
Affected packages (2)
- crates.io/coreutilsfrom 0, < 0.6.0
- Debian/rust-coreutilsfrom 0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
References (6)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-35338
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2026-35338
- PATCHhttps://github.com/uutils/coreutils
- WEBhttps://github.com/uutils/coreutils/commit/413055b378fa6fe2299c5e5f538c8e6e841ab810
- WEBhttps://github.com/uutils/coreutils/pull/10033
- WEBhttps://github.com/uutils/coreutils/releases/tag/0.6.0