TOCTOU Vulnerability in uutils Coreutils Install Utility

CVE-2026-35356

What is CVE-2026-35356?

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when employing the -D flag. This issue arises during the creation of parent directories and subsequent path resolution to create the target file, as neither operation is secured by a directory file descriptor. An attacker with simultaneous write permissions can exploit this gap by swapping a path component with a symbolic link, leading to unauthorized privileged write operations directed at arbitrary locations within the file system.

References