CVE-2026-35359 Details

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the cp utility of uutils coreutils. This vulnerability allows an attacker to bypass the no-dereference intent when handling symbolic links. The issue arises because the cp utility first checks if a source path is a symbolic link using metadata that follows the link, but then opens the file without the O_NOFOLLOW flag. An attacker with concurrent write access can exploit this timing window by replacing a regular file with a symbolic link to a sensitive target, causing a privileged cp process to inadvertently copy the contents of sensitive files to a location controlled by the attacker.