Path Traversal Vulnerability in uutils Coreutils Allows Bypass of Safety Mechanism

CVE-2026-35338

What is CVE-2026-35338?

A vulnerability in the chmod utility of uutils coreutils allows users to bypass the safety mechanism intended to preserve the root directory. Due to insufficient path validation, an attacker can leverage path variants like /../ or symbolic links to perform destructive operations recursively, such as changing permissions for the entire root filesystem. This misconfiguration can lead to widespread permission loss and could potentially compromise system functionality.

References