PT-2026-34508 · Unknown · Uutils Coreutils

Zellic · Published 2026-04-22 · Updated 2026-05-04 · CVE-2026-35372

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions uutils coreutils (affected versions not specified)

Description A logic error in the ln utility allows it to dereference a symbolic link target even when the --no-dereference (or -n) flag is used. The utility only honored the no-dereference intent if the --force mode was also enabled. This causes ln to follow a symbolic link pointing to a directory and create new links inside that target directory rather than treating the symbolic link as the destination. A local attacker could manipulate existing symbolic links to redirect file creation into sensitive directories, potentially leading to unauthorized file creation or system misconfiguration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-61

Related Identifiers

CVE-2026-35372

GHSA-WQ63-VH5H-PR5P

Affected Products

Uutils Coreutils

References · 13

• https://github.com/uutils/coreutils/pull/11253 · Patch
• https://github.com/uutils/coreutils/releases/tag/0.8.0 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-35372 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wq63-vh5h-pr5p · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-35372 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-35372 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35372 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-35372 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-35372 · Security Note
• https://github.com/uutils/coreutils/commit/394c4b17f2f382b4be9f54389bcb79028de02f39 · Note
• https://github.com/uutils/coreutils · Note
• https://twitter.com/CVEnew/status/2047012081480974409 · Twitter Post
• https://t.me/cveNotify/162060 · Telegram Post