CVE-2026-35362

Description

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

PUBLISHED Reserved 2026-04-02 | Published 2026-04-22 | Updated 2026-04-22 | Assigner canonical

Problem types

CWE-367: Time-of-Check Time-of-Use (TOCTOU) Race Condition

Product status

Credits

Zellic finder

References

github.com/uutils/coreutils/pull/9792 issue-tracking patch

github.com/uutils/coreutils/releases/tag/0.6.0 vendor-advisory

cve.org (CVE-2026-35362)

nvd.nist.gov (CVE-2026-35362)

Download JSON