Output File Permission Flaw in uutils Coreutils Affects Security

CVE-2026-35367

What is CVE-2026-35367?

The nohup utility within uutils coreutils creates its default output file, nohup.out, with inherited umask-based permissions, resulting in a file that is potentially world-readable (0644). In environments with multiple users, this poses a significant risk as it could grant any user access to sensitive information captured in the stdout/stderr output of executed commands. This behavior contrasts with the GNU coreutils implementation, which restricts access to owner-only (0600) permissions, thereby enhancing security and protecting against unauthorized data exposure.

References