CVE-2026-35362: uutils coreutils Missing TOCTOU Protection on Non-Linux Unix Platforms in Safe Traversal Module
The safetraversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/uucoreto a version that resolves this vulnerability.Fixed in 0.6.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35362?
CVE-2026-35362 has been rated as a high severity vulnerability due to the missing TOCTOU protection on non-Linux Unix platforms.
How do I fix CVE-2026-35362?
To mitigate CVE-2026-35362, update to the latest release of uutils coreutils that addresses this vulnerability.
Who is affected by CVE-2026-35362?
CVE-2026-35362 affects users of uutils coreutils specifically on non-Linux Unix platforms.
What type of vulnerability is CVE-2026-35362?
CVE-2026-35362 is a Time-of-Check to Time-of-Use (TOCTOU) vulnerability which can lead to symlink race conditions.
Is there a known exploit for CVE-2026-35362?
As of now, there are no publicly available exploit details for CVE-2026-35362.