CVE-2026-35362

Katalog CVE

CVSS 3.6 · Low EPSS 0,20%

Kerentanan Time-of-check Time-of-use (TOCTOU) Race Condition pada uutils coreutils. Skor CVSS 3.1 3.6 (Low) menurut ubuntu.com.

Deskripsi (NVD)

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Rincian

Terbit di NVD

22 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.6 (Low), sumber ubuntu.com
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/uutils/coreutils/pull/9792 issue tracking · patch
• https://github.com/uutils/coreutils/releases/tag/0.6.0 release notes