CVE-2026-35338: uutils coreutils chmod Path Traversal Bypass of --preserve-root
Chmoder::chmod() only compares the literal argument against Path::new("/"), so the --preserve-root guard is bypassed by any path that resolves to root — a symlink to / or simply /../.
if self.recursive && self.preserveroot && file == Path::new("/") { return Err(ChmodError::PreserveRoot("/".tostring()).into()); }
PoC — recursively chmods the entire filesystem to 000 despite --preserve-root:
chmod -R --preserve-root 000 /../ -v
Impact: --preserve-root is the documented safeguard against destructive recursive operations on /. Bypassing it allows chmod -R to alter permissions across the whole filesystem, causing a complete system breakdown. Recommendation: canonicalize the target path before comparing against root.
Remediation: Acknowledged by Canonical; fixed in commit 413055b3.
--- Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.1. Credit: Zellic.
Other sources
A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism. The implementation only validates if the target path is literally / and does not canonicalize the path. An attacker or accidental user can use path variants such as /../ or symbolic links to execute destructive recursive operations (e.g., chmod -R 000) on the entire root filesystem, leading to system-wide permission loss and potential complete system breakdown.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/uu_chmodto a version that resolves this vulnerability.Fixed in 0.6.0 - Upgrade
Upgrade
uutils coreutils chmodto a version that resolves this vulnerability.Patch 413055b3 - Upgrade
Upgrade
uutils coreutils chmodto a version that resolves this vulnerability.Patch 3a07ffc5a9bd4c283e75afa548ba1f1957bad242 - Configuration
Update Chmoder::chmod() to canonicalize the resolved target path before performing the --preserve-root check, so paths like /../ or a symlink to / cannot bypass the guard.
uutils coreutils chmod (Chmoder::chmod) --preserve-root path comparison logic = Canonicalize the target path before comparing against root; reject when resolved target is /, not only when the literal argument equals Path::new("/")
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35338?
CVE-2026-35338 is classified as a medium severity vulnerability due to its potential for path traversal attacks.
How do I fix CVE-2026-35338?
To fix CVE-2026-35338, upgrade to the latest version of uutils coreutils that addresses this vulnerability.
What type of attack can CVE-2026-35338 facilitate?
CVE-2026-35338 can facilitate path traversal attacks allowing an unauthorized user to alter sensitive files.
Who is affected by CVE-2026-35338?
Users of uutils coreutils versions prior to the fix are affected by CVE-2026-35338.
Is CVE-2026-35338 a local or remote vulnerability?
CVE-2026-35338 is considered a local vulnerability, as it requires local access to execute the chmod command.