CVE-2026-35360 Details
Description
The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the utility identifies a missing path, it later attempts creation using File::create(), which internally uses O_TRUNC. An attacker can exploit this window to create a file or swap a symlink at the target path, causing touch to truncate an existing file and leading to permanent data loss.
A TOCTOU (Time-of-Check to Time-of-Use) race condition vulnerability has been identified in the touch utility of uutils coreutils. This issue arises during file creation when the utility first checks for the existence of a path. If the path is missing, it attempts to create the file using File::create(), which includes the O_TRUNC option. An attacker can exploit this timing window to create a file or replace a symlink at the target location, causing the touch utility to truncate an existing file and result in permanent data loss. This vulnerability is particularly concerning when touch is executed in directories writable by the attacker or on paths controlled by the attacker, especially with elevated privileges.
Users are advised to avoid using the touch utility in directories or on paths where they do not have control, especially when running with elevated privileges.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/uutils/coreutils/issues/10019 | CISA-ADP | ExploitIssue TrackingVendor Advisory |
| https://github.com/uutils/coreutils/issues/10019 | [email protected] | ExploitIssue TrackingVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| uutils coreutils | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | New CVE Received | [email protected] |