Directory Permission Flaw in uutils Coreutils Affects User Privacy

CVE-2026-35353

What is CVE-2026-35353?

The mkdir utility in uutils coreutils has a flaw related to how it handles directory permissions when the -m flag is used. Instead of applying the specified permissions directly, it first creates the directory with default umask-derived permissions, typically set to 0755. This can inadvertently expose the directory to other users in multi-user environments, creating a temporary lapse in privacy and security. Users may find sensitive data accessible to unauthorized parties due to this vulnerability, highlighting the need for careful permission management in software design.

References