{"id":"CVE-2026-35350","revision":"08710a73a28b486c846438cb61873908","records":[{"revision":"08710a73a28b486c846438cb61873908","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-35350","aliases":[],"title":"uutils coreutils cp Unexpected Privileged Executable Creation with -p","description":"The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.","state":0,"publishedAt":"2026-04-22T16:08:02.526+00:00","modifiedAt":"2026-04-22T17:58:14.456+00:00","affected":[{"ecosystem":"https://github.com/uutils","name":"coreutils","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Uutils\",\n                    \"product\": \"coreutils\",\n                    \"platforms\": [\n                        \"Linux\",\n                        \"Unix\",\n                        \"macOS\"\n                    ],\n                    \"collectionURL\": \"https://github.com/uutils\",\n                    \"packageName\": \"coreutils\",\n                    \"repo\": \"https://github.com/uutils/coreutils\",\n                    \"defaultStatus\": \"affected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","score":6.6,"severity":"MEDIUM"}],"references":["https://github.com/uutils/coreutils/issues/9750"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-35350","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-35350","identifiers":["CVE-2026-35350"]},"retained":false,"historicalAffected":[]}],"coverage":[]}