CVE-2026-35355: uutils coreutils install Arbitrary File Overwrite via Symlink TOCTOU Race
copyfile in install/src/install.rs removes the destination then recreates it by pathname via File::create / fs::copy without OEXCL/createnew. Between the unlink and the recreate, a local attacker with write access to the destination directory can drop in a symlink and redirect the write.
Impact: when install runs privileged into an attacker-writable directory (staging/build paths), the race allows redirecting writes to arbitrary files and overwriting sensitive system files (/etc/passwd, /etc/shadow). Recommendation: create atomically with createnew/OEXCL and copy via the opened fd rather than reopening by path.
Remediation: Acknowledged by Canonical; fixed in commit b5bbabc1.
--- Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.50. Credit: Zellic.
Other sources
The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation. The implementation unlinks an existing destination file and then recreates it using a path-based operation without the OEXCL flag. A local attacker can exploit the window between the unlink and the subsequent creation to swap the path with a symbolic link, allowing them to redirect privileged writes to overwrite arbitrary system files.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/uu_installto a version that resolves this vulnerability.Fixed in 0.6.0 - Upgrade
Upgrade
uutils coreutils installto a version that resolves this vulnerability.Patch b5bbabc1 - Configuration
Fix the TOCTOU race by creating the destination atomically (create_new / O_EXCL) and copying through the already-opened destination file descriptor, rather than unlinking the destination and recreating it by pathname using File::create / fs::copy without O_EXCL.
uutils coreutils install (install/src/install.rs copy_file) file creation atomicity (use O_EXCL/create_new and copy via opened fd) = use create_new/O_EXCL for destination and copy via opened file descriptor instead of unlink + path-based recreate
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35355?
CVE-2026-35355 is considered a moderate severity vulnerability due to its potential for arbitrary file overwrite.
How do I fix CVE-2026-35355?
To fix CVE-2026-35355, update to the latest version of uutils coreutils where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-35355?
CVE-2026-35355 is a Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability affecting the install utility in uutils coreutils.
Which versions of uutils coreutils are affected by CVE-2026-35355?
CVE-2026-35355 affects all versions of uutils coreutils prior to the patch included in version 0.6.0.
What could be the impact of exploiting CVE-2026-35355?
Exploiting CVE-2026-35355 could allow an attacker to overwrite arbitrary files on the system, potentially leading to data loss or system compromise.