{"id":"EUVD-2026-24977","enisaUuid":"2d2da47f-7ebf-3e32-82b8-91c189868568","description":"A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow\u003dname option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link\u0027s target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file.","datePublished":"Apr 22, 2026, 4:07:49 PM","dateUpdated":"Apr 22, 2026, 6:13:19 PM","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/uutils/coreutils/issues/10328\n","aliases":"CVE-2026-35345\n","assigner":"canonical","epss":0.1,"enisaIdProduct":[],"enisaIdVendor":[],"enisaIdVulnerability":[{"id":"1a81bf52-4b31-32f6-bde4-fcc3e8f43997","vulnerability":{"id":"GHSA-xf75-659h-cgg5","description":"uutils coreutils has a Link Following Issue","datePublished":"Apr 22, 2026, 6:31:44 PM","dateUpdated":"Apr 29, 2026, 10:58:55 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-35345\nhttps://github.com/uutils/coreutils/issues/10328\nhttps://github.com/uutils/coreutils\n","enisa_id":"EUVD-2026-24977\n","aliases":"GHSA-xf75-659h-cgg5\nCVE-2026-35345\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"57002ea2-8d1a-33a5-99e6-d9a224563962","vulnerability":{"id":"CVE-2026-35345","description":"A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow\u003dname option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link\u0027s target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file.","datePublished":"Apr 22, 2026, 4:07:49 PM","dateUpdated":"Apr 22, 2026, 6:13:19 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N","references":"https://github.com/uutils/coreutils/issues/10328\n","enisa_id":"EUVD-2026-24977\n","assigner":"canonical","epss":0.1,"dataProcessed":"Oct 27, 2026, 7:19:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}