{"id":"EUVD-2026-24963","enisaUuid":"622bcba4-3a8e-378b-a36e-4db7cf26db7a","description":"A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism. The implementation only validates if the target path is literally / and does not canonicalize the path. An attacker or accidental user can use path variants such as /../ or symbolic links to execute destructive recursive operations (e.g., chmod -R 000) on the entire root filesystem, leading to system-wide permission loss and potential complete system breakdown.","datePublished":"Apr 22, 2026, 4:07:31 PM","dateUpdated":"Apr 24, 2026, 3:55:21 AM","baseScore":7.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","references":"https://github.com/uutils/coreutils/pull/10033\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","aliases":"CVE-2026-35338\nGHSA-4c7q-4928-8445\n","assigner":"canonical","epss":0.18,"enisaIdProduct":[{"id":"adce1ca0-7778-3ecc-8879-b6aa0536dd06","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.6.0"}],"enisaIdVendor":[{"id":"b4e838a5-f3c4-3c7f-865d-8028f44f6704","vendor":{"name":"Uutils"}}],"enisaIdVulnerability":[{"id":"1b75bfbf-02cd-3462-b822-5cf6cbd900a9","vulnerability":{"id":"CVE-2026-35338","description":"A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism. The implementation only validates if the target path is literally / and does not canonicalize the path. An attacker or accidental user can use path variants such as /../ or symbolic links to execute destructive recursive operations (e.g., chmod -R 000) on the entire root filesystem, leading to system-wide permission loss and potential complete system breakdown.","datePublished":"Apr 22, 2026, 4:07:31 PM","dateUpdated":"Apr 24, 2026, 3:55:21 AM","status":"PUBLISHED","baseScore":7.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","references":"https://github.com/uutils/coreutils/pull/10033\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","enisa_id":"EUVD-2026-24963\n","assigner":"canonical","epss":0.18,"dataProcessed":"Oct 30, 2026, 7:18:58 AM","vulnerabilityProduct":[{"id":"41c73cb7-b0a5-3b13-a65a-eeb392917ed8","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.6.0"}],"vulnerabilityVendor":[{"id":"f8eec112-7413-37f3-a143-5045bab496ea","vendor":{"name":"Uutils"}}]}},{"id":"526cdb0a-a67a-397b-b78b-076b3ba26aab","vulnerability":{"id":"GHSA-4c7q-4928-8445","description":"chmod: --preserve-root bypassed by any path that resolves to root (e.g. /../)","datePublished":"Jul 6, 2026, 5:41:45 PM","dateUpdated":"Jul 6, 2026, 5:41:45 PM","baseScore":0.0,"references":"https://github.com/uutils/coreutils/security/advisories/GHSA-4c7q-4928-8445\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35338\nhttps://github.com/uutils/coreutils/pull/10033\nhttps://github.com/uutils/coreutils/commit/413055b378fa6fe2299c5e5f538c8e6e841ab810\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","enisa_id":"EUVD-2026-24963\n","aliases":"GHSA-4c7q-4928-8445\nCVE-2026-35338\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"7c33436b-bb8a-32f4-b06f-3fc7dea01cad","vulnerability":{"id":"GHSA-9gqx-53gp-c8g3","description":"Duplicate Advisory: uutils coreutils allows users to bypass the --preserve-root safety mechanism","datePublished":"Apr 22, 2026, 6:31:44 PM","dateUpdated":"Jul 6, 2026, 5:41:39 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-35338\nhttps://github.com/uutils/coreutils/pull/10033\nhttps://github.com/uutils/coreutils/commit/413055b378fa6fe2299c5e5f538c8e6e841ab810\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","enisa_id":"EUVD-2026-24963\n","aliases":"GHSA-9gqx-53gp-c8g3\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}