PT-2026-34500 · Unknown · Uutils Coreutils

Zellic · Published 2026-04-22 · Updated 2026-04-23 · CVE-2026-35364

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions uutils coreutils (affected versions not specified)

Description A Time-of-Check to Time-of-Use (TOCTOU) race condition occurs in the 'mv' utility during cross-device operations. This happens because the utility removes the destination path before recreating it via a copy operation. A local attacker with write access to the destination directory can replace the destination with a symbolic link during this interval. Consequently, the privileged move operation follows the symlink, enabling the attacker to redirect the write process and overwrite an arbitrary target file with the source contents. TOCTOU is a software bug where a system checks a condition and then assumes it remains true for a subsequent operation, creating a window for manipulation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2026-35364

GHSA-M976-87WM-48FM

Affected Products

Uutils Coreutils

References · 10

• 🔥 https://github.com/uutils/coreutils/issues/10015 · Exploit
• https://osv.dev/vulnerability/GHSA-m976-87wm-48fm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35364 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-35364 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35364 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-35364 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35364 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-35364 · Vendor Advisory
• https://github.com/uutils/coreutils · Note
• https://twitter.com/CVEnew/status/2047012090066677811 · Twitter Post