CVE-2026-35338 Details
Description
A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism. The implementation only validates if the target path is literally / and does not canonicalize the path. An attacker or accidental user can use path variants such as /../ or symbolic links to execute destructive recursive operations (e.g., chmod -R 000) on the entire root filesystem, leading to system-wide permission loss and potential complete system breakdown.
A vulnerability exists in the uutils coreutils chmod utility, specifically in version 0.6.0, which allows users to circumvent the --preserve-root safety feature. The issue arises because the implementation only checks if the target path is exactly '/' and fails to canonicalize the path. This flaw enables an attacker or an unintentional user to use path variants like '/../' or symbolic links to perform harmful recursive actions, such as recursively changing permissions to '000' on the entire root filesystem. Such actions can result in a widespread loss of system permissions and potentially cause a complete system failure.
Users can update to uutils coreutils version 0.6.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/uutils/coreutils/pull/10033 | [email protected] | Issue TrackingPatch |
| https://github.com/uutils/coreutils/releases/tag/0.6.0 | [email protected] | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| uutils coreutils | < 0.6.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | New CVE Received | [email protected] |