CVE-2026-35365 Details
Description
The mv utility in uutils coreutils improperly handles directory trees containing symbolic links during moves across filesystem boundaries. Instead of preserving symlinks, the implementation expands them, copying the linked targets as real files or directories at the destination. This can lead to resource exhaustion (disk space or time) if symlinks point to large external directories, unexpected duplication of sensitive data into unintended locations, or infinite recursion and repeated copying in the presence of symlink loops.
A vulnerability exists in the mv utility of uutils coreutils version 0.7.0, released on March 8, 2026. The issue arises when moving directory trees that contain symbolic links across different filesystem boundaries. Instead of maintaining the symlinks, the utility expands them, copying the linked targets as actual files or directories at the destination. This behavior can cause resource exhaustion, such as excessive disk space usage or prolonged operation times, especially if the symlinks reference large external directories. Additionally, it may lead to unintended duplication of sensitive data in inappropriate locations or trigger infinite recursion and repeated copying when symlink loops are present.
Users can update to uutils coreutils version 0.7.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/uutils/coreutils/pull/10546 | [email protected] | Issue TrackingPatch |
| https://github.com/uutils/coreutils/releases/tag/0.7.0 | [email protected] | Release Notes |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| uutils coreutils | < 0.7.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | New CVE Received | [email protected] |