PT-2026-34501 · Unknown · Uutils Coreutils

Zellic · Published 2026-04-22 · Updated 2026-04-22 · CVE-2026-35365

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions uutils coreutils (affected versions not specified)

Description The mv utility improperly handles directory trees containing symbolic links when moving them across filesystem boundaries. The implementation expands symbolic links—which are pointers to other files or directories—and copies the linked targets as real files or directories at the destination instead of preserving the links. This behavior can result in resource exhaustion of disk space or time if links point to large external directories, unexpected duplication of sensitive data, or infinite recursion and repeated copying when symbolic link loops are present.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2026-35365

Affected Products

Uutils Coreutils

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-35365 · Security Note
• https://github.com/uutils/coreutils/pull/10546 · Patch
• https://github.com/uutils/coreutils/releases/tag/0.7.0 · Vendor Advisory
• https://twitter.com/CVEnew/status/2047012089018085851 · Twitter Post