UBUNTU-CVE-2026-35363: Medium severity ubuntu/rust-coreutils vulnerability
A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading 'Invalid input' error, which may cause users to miss the critical window for data recovery.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/rust-coreutilsto a version that resolves this vulnerability.Fixed in 0.10.0-1ubuntu2~26.04.1
Event History
Frequently Asked Questions
Can this be exploited remotely?
No. The vulnerability is rated with a local attack vector, so exploitation requires local access to a system where the affected utility is used.
What level of access does an attacker need?
The CVSS vector indicates low privileges are required. User interaction is also required.
Does the issue expose data outside the current working directory?
The provided impact assessment lists no confidentiality impact. The described effect is recursive deletion of the contents of the current directory, with integrity and availability impacts.