CVE-2026-35363

MEDIUM5.6EPSS 0.01%

uutils coreutils has a Path Traversal issue

發布日:2026/4/22修改日:2026/6/2
也稱為:GHSA-vchc-9ggh-3236CGA-fx2x-7x9q-pxh9

描述

A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading 'Invalid input' error, which may cause users to miss the critical window for data recovery.

受影響套件(2)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1MEDIUM5.6CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L

參考連結(4)