PT-2026-34495 · Unknown · Uutils Coreutils

Zellic · Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-35359

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions uutils coreutils (affected versions not specified)

Description A Time-of-Check to Time-of-Use (TOCTOU) issue in the cp utility allows an attacker to bypass no-dereference intent. The utility verifies if a source path is a symbolic link using path-based metadata but opens it without the O NOFOLLOW flag. An attacker with concurrent write access can replace a regular file with a symbolic link during this interval, leading a privileged cp process to copy arbitrary sensitive files into a destination controlled by the attacker. TOCTOU is a race condition where a system resource is modified between the time it is checked and the time it is used.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Link Following

Time Of Check To Time Of Use

Weakness Enumeration

CWE-59

CWE-367

Related Identifiers

CVE-2026-35359

GHSA-HPFW-MQM3-33JH

Affected Products

Uutils Coreutils

References · 10

• 🔥 https://github.com/uutils/coreutils/issues/10017 · Exploit
• https://ubuntu.com/security/CVE-2026-35359 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35359 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35359 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-35359 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35359 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-35359 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hpfw-mqm3-33jh · Vendor Advisory
• https://github.com/uutils/coreutils · Note
• https://twitter.com/CVEnew/status/2047012095439610354 · Twitter Post