Vulnerability in Uutils Coreutils rm Utility Allows Path Bypass

CVE-2026-35349

What is CVE-2026-35349?

A flaw in the rm utility of Uutils Coreutils permits the bypass of the --preserve-root safeguard. This issue arises from the use of a path-string check rather than direct comparisons of device and inode numbers to validate the root directory. An attacker or accidental user can exploit this weakness by utilizing a symbolic link that resolves to the root directory, resulting in the possibility of unintentionally deleting the entire root filesystem.

References