PT-2026-34487 · Unknown · Uutils Coreutils

Zellic · Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-35351

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions uutils coreutils (affected versions not specified)

Description The mv utility fails to preserve file ownership when moving files across different filesystem boundaries. In these instances, the utility uses a copy-and-delete routine that creates the destination file using the caller's UID (User Identifier) and GID (Group Identifier) instead of the source's metadata. This behavior can result in files moved by a privileged user becoming owned by that user, potentially leading to restricted access for intended owners or information disclosure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2026-35351

GHSA-957R-R8GC-VV3H

Affected Products

Uutils Coreutils

References · 11

• 🔥 https://github.com/uutils/coreutils/issues/9714 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35351 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35351 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-35351 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35351 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-35351 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-957r-r8gc-vv3h · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-35351 · Vendor Advisory
• https://github.com/uutils/coreutils · Note
• https://github.com/uutils/coreutils/pull/11706 · Note
• https://twitter.com/CVEnew/status/2047012104058871913 · Twitter Post