Uutils coreutils Cp Utility toctou

Summaryinfo

A vulnerability identified as problematic has been detected in Uutils coreutils. This issue affects some unknown processing of the component Cp Utility. This manipulation causes toctou. This vulnerability is handled as CVE-2026-35359. It is possible to launch the attack on the local host. There is not any exploit available.

Detailsinfo

A vulnerability classified as problematic was found in Uutils coreutils (affected version not known). Affected by this vulnerability is some unknown functionality of the component Cp Utility. The manipulation with an unknown input leads to a toctou vulnerability. The CWE definition for the vulnerability is CWE-367. The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state. As an impact it is known to affect confidentiality. The summary by CVE is:

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.

The weakness was released by Zellic. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-35359 since 04/02/2026. The exploitation appears to be difficult. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Uutils

Name

• coreutils

Website

• Product: https://github.com/uutils/coreutils/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion