CVE-2026-35363: uutils coreutils rm Safeguard Bypass via Improper Path Normalization
rm -rf . is correctly refused, but cleantrailingslashes normalizes ./// to ./ while pathiscurrentorparentdirectory only matches ./.. (and /.//..), not ./ or ../. So rm -rf ./ recursively deletes the directory's contents and then prints a misleading cannot remove './': Invalid input.
Impact: all files/subdirectories in the current directory are silently deleted; the misleading error makes users miss the recovery window. Recommendation: handle trailing-slash variants in pathiscurrentorparentdirectory.
Remediation: Acknowledged by Canonical; fixed in commit d0e5af23.
--- Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.60. Credit: Zellic.
Upstream tracking issue: https://github.com/uutils/coreutils/issues/9749 · CVE-2026-35363
Other sources
A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading 'Invalid input' error, which may cause users to miss the critical window for data recovery.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rust/uu_rmto a version that resolves this vulnerability.Fixed in 0.6.0 - Upgrade
Upgrade
uutils coreutils rmto a version that resolves this vulnerability.Patch d0e5af23 - Upgrade
Upgrade
uutils coreutilsto a version that resolves this vulnerability.Patch 3a07ffc5a9bd4c283e75afa548ba1f1957bad242
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35363?
CVE-2026-35363 has a medium severity level due to its potential to bypass safeguards in the rm utility.
How do I fix CVE-2026-35363?
To fix CVE-2026-35363, update to the latest version of uutils coreutils where this vulnerability is patched.
What are the potential impacts of CVE-2026-35363?
The potential impact of CVE-2026-35363 includes accidental deletion of critical files in the current directory.
Who is affected by CVE-2026-35363?
Users of uutils coreutils that utilize the rm utility are affected by CVE-2026-35363.
What should I do if I cannot update uutils coreutils to mitigate CVE-2026-35363?
If updating is not possible, avoid using the rm utility in contexts where it may lead to accidental deletion of files.