TOCTOU Vulnerability in uutils coreutils cp Utility

CVE-2026-35359

What is CVE-2026-35359?

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the cp utility of uutils coreutils. This flaw allows an attacker to exploit the timing difference between checking a symbolic link's status and opening it. The cp utility verifies if a source path is a symbolic link through path-based metadata but fails to use the O_NOFOLLOW flag when opening the link. An attacker with concurrent write access can take advantage of this timing gap to swap a regular file for a symbolic link, allowing sensitive file contents to be copied to a destination under the attacker's control, posing significant security risks.

References