Home

Description

The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the utility identifies a missing path, it later attempts creation using File::create(), which internally uses O_TRUNC. An attacker can exploit this window to create a file or swap a symlink at the target path, causing touch to truncate an existing file and leading to permanent data loss.

PUBLISHED Reserved 2026-04-02 | Published 2026-04-22 | Updated 2026-04-22 | Assigner canonical




MEDIUM: 6.3CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Problem types

CWE-367: Time-of-Check Time-of-Use (TOCTOU) Race Condition

Product status

Default status
affected

Credits

Zellic finder

References

github.com/uutils/coreutils/issues/10019 exploit

github.com/uutils/coreutils/issues/10019 issue-tracking

cve.org (CVE-2026-35360)

nvd.nist.gov (CVE-2026-35360)

Download JSON