PT-2026-34478 · Unknown · Uutils Coreutils

Zellic · Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-35342

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions uutils coreutils (affected versions not specified)

Description The mktemp utility fails to properly handle an empty TMPDIR environment variable. While other implementations fall back to /tmp when TMPDIR is an empty string, this implementation treats the empty string as a valid path, resulting in temporary files being created in the current working directory. This behavior can lead to unauthorized access to temporary data or information disclosure if the current working directory has more permissive access controls than the intended secure temporary directory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-377

Related Identifiers

CVE-2026-35342

GHSA-2CXP-XQ3C-MJXX

Affected Products

Uutils Coreutils

References · 12

• https://github.com/uutils/coreutils/pull/10566 · Patch
• https://github.com/uutils/coreutils/releases/tag/0.6.0 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2cxp-xq3c-mjxx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35342 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-35342 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35342 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-35342 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-35342 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35342 · Vendor Advisory
• https://github.com/uutils/coreutils · Note
• https://github.com/uutils/coreutils/commit/eb25ec328b226d8fbbaa4058bf9187165bf06d51 · Note
• https://twitter.com/CVEnew/status/2047012113663893844 · Twitter Post