CVE-2026-35342 Details
Description
The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid path. This causes temporary files to be created in the current working directory (CWD) instead of the intended secure temporary directory. If the CWD is more permissive or accessible to other users than /tmp, it may lead to unintended information disclosure or unauthorized access to temporary data.
A vulnerability exists in the uutils coreutils implementation of the mktemp utility, specifically in version 0.6.0. The issue arises because the utility does not correctly manage an empty TMPDIR environment variable. Unlike its GNU counterpart, which defaults to /tmp when TMPDIR is empty, uutils mktemp treats the empty string as a valid path. This flaw leads to the creation of temporary files in the current working directory (CWD) instead of a secure temporary directory. If the CWD has more permissive access than /tmp, this behavior could result in unintended information disclosure or unauthorized access to temporary data.
Users can update to uutils coreutils version 0.6.0 or later, where this issue has been addressed. Instructions for downloading the latest version are available on the uutils coreutils GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/uutils/coreutils/pull/10566 | [email protected] | Issue TrackingPatch |
| https://github.com/uutils/coreutils/releases/tag/0.6.0 | [email protected] | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-377 | Insecure Temporary File | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| uutils coreutils | < 0.6.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | New CVE Received | [email protected] |