Exfiltration Vulnerability in uutils Coreutils Tail Utility

CVE-2026-35345

What is CVE-2026-35345?

A flaw in the tail utility of uutils coreutils permits attackers to exfiltrate sensitive file contents by exploiting the --follow=name option. Unlike its GNU counterpart, the uutils version continues to track the file path even after it is replaced with a symbolic link. This allows a local user with write permissions in a monitored directory to substitute a log file with a symlink to a sensitive file (e.g., /etc/shadow), resulting in the unintended disclosure of critical file contents. This vulnerability could expose sensitive information, impacting overall system security.

References