CVE-2026-35356: uutils coreutils install Arbitrary File Overwrite with -D via Path Component Symlink Race
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command creates parent directories and subsequently performs a second path resolution to create the target file, neither of which is anchored to a directory file descriptor. An attacker with concurrent write access can replace a path component with a symbolic link between these operations, redirecting the privileged write to an arbitrary file system location.
Other sources
The -D path runs fs::createdirall on a pathname then later opens the destination via path-based File::create/fs::copy, neither anchored to a directory fd. Between the two, an attacker can replace a path component with a symlink, redirecting the write.
Impact: an attacker with concurrent write access to the destination tree can redirect a privileged install -D to an arbitrary location, enabling arbitrary file overwrite with attacker-controlled content. Recommendation: use dirfd-based traversal (openat/mkdirat + ONOFOLLOW) per component and create the destination via openat on the same dirfd.
Remediation: Acknowledged by Canonical; fixed in commit 0c412999.
--- Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.51. Credit: Zellic.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/uu_installto a version that resolves this vulnerability.Fixed in 0.7.0 - Upgrade
Upgrade
uutils coreutils install (install utility)to a version that resolves this vulnerability.Patch 0c412999
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35356?
CVE-2026-35356 is classified as a medium severity vulnerability due to its potential for arbitrary file overwrite.
How do I fix CVE-2026-35356?
To fix CVE-2026-35356, update to the latest version of uutils coreutils where the vulnerability has been addressed.
What is the impact of CVE-2026-35356?
The impact of CVE-2026-35356 includes the risk of unauthorized file modification or replacement due to a symlink race condition.
Which versions of uutils coreutils are affected by CVE-2026-35356?
CVE-2026-35356 affects uutils coreutils prior to the patched version released in 0.7.0.
What causes CVE-2026-35356?
CVE-2026-35356 is caused by a time-of-check to time-of-use (TOCTOU) vulnerability in the install utility when using the -D flag.