{"id":"EUVD-2026-24981","revision":"2fcb2ce103f144f2b0d8a5a2de237b52","records":[{"revision":"2fcb2ce103f144f2b0d8a5a2de237b52","observedAt":"2026-10-28T04:55:02.855+00:00","statement":{"source":"euvd","id":"EUVD-2026-24981","aliases":["CVE-2026-35349","GHSA-7cr3-h577-g38j"],"title":"A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. The implementation uses a path-string check rather than comparing device and inode numbers to identify the root directory. An attacker …","description":"A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. The implementation uses a path-string check rather than comparing device and inode numbers to identify the root directory. An attacker or accidental user can bypass this safeguard by using a symbolic link that resolves to the root directory (e.g., /tmp/rootlink -> /), potentially leading to the unintended recursive deletion of the entire root filesystem.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","score":6.7,"severity":null}],"references":["https://github.com/uutils/coreutils/pull/9706","https://github.com/uutils/coreutils/releases/tag/0.7.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24981","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 22, 2026, 4:07:59 PM","dateUpdated":"Apr 22, 2026, 6:05:13 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-24981","identifiers":["EUVD-2026-24981","CVE-2026-35349","GHSA-7cr3-h577-g38j"]},"retained":false,"historicalAffected":[]}],"coverage":[]}