Uutils coreutils up to 0.5.x Recursive Mode function return value

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Uutils coreutils up to 0.5.x. The impacted element is an unknown function of the component Recursive Mode. The manipulation leads to function return value. This vulnerability is listed as CVE-2026-35339. The attack must be carried out locally. There is no available exploit. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Uutils coreutils up to 0.5.x. This issue affects an unknown functionality of the component Recursive Mode. The manipulation with an unknown input leads to a function return value vulnerability. Using CWE to declare the problem leads to CWE-253. The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions. Impacted is integrity. The summary by CVE is:

The recursive mode (-R) of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple files. The final return value is determined solely by the success or failure of the last file processed. This allows the command to return an exit code of 0 (success) even if errors were encountered on previous files, such as 'Operation not permitted'. Scripts relying on these exit codes may proceed under a false sense of success while sensitive files remain with restrictive or incorrect permissions.

The weakness was presented by Zellic. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-35339 since 04/02/2026. The exploitation is known to be easy. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 0.6.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Uutils

Name

• coreutils

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5

Website

• Product: https://github.com/uutils/coreutils/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion