Path Traversal Vulnerability in uutils coreutils rm Utility

CVE-2026-35363

What is CVE-2026-35363?

A vulnerability in the rm utility of uutils coreutils allows for bypassing safeguards designed to protect the current directory. Although the utility refuses to delete directory references like '.' and '..', it fails to account for equivalent paths with trailing slashes, such as './' or './//'. This oversight can lead to unintended consequences; for instance, executing 'rm -rf ./' may result in the entire contents of the current directory being deleted silently. This operation can further obscure the data loss by issuing a deceptive 'Invalid input' error, which might prevent users from taking timely action to recover their deleted data.

References