{"id":"EUVD-2026-24988","enisaUuid":"d4a8d8e4-ace4-357a-8915-ef8d46cbb000","description":"The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically 0755) before subsequently changing them to the requested mode via a separate chmod system call. In multi-user environments, this introduces a brief window where a directory intended to be private is accessible to other users, potentially leading to unauthorized data access.","datePublished":"Apr 22, 2026, 4:08:09 PM","dateUpdated":"Apr 22, 2026, 5:49:45 PM","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/uutils/coreutils/pull/10036\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","aliases":"CVE-2026-35353\nGHSA-mj6p-44ch-cq69\n","assigner":"canonical","epss":0.1,"enisaIdProduct":[{"id":"0beb0592-b3f7-33c3-a060-db116e2fc7c5","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.6.0"}],"enisaIdVendor":[{"id":"24d865b0-efd0-3cfc-9fc3-24972764215f","vendor":{"name":"Uutils"}}],"enisaIdVulnerability":[{"id":"0be2c5f4-9230-3adf-99b0-2fca216d70e7","vulnerability":{"id":"GHSA-mj6p-44ch-cq69","description":"mkdir: -m exposes directory with umask perms before chmod (race window)","datePublished":"Jul 6, 2026, 8:16:16 PM","dateUpdated":"Jul 6, 2026, 8:16:16 PM","baseScore":0.0,"references":"https://github.com/uutils/coreutils/security/advisories/GHSA-mj6p-44ch-cq69\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35353\nhttps://github.com/uutils/coreutils/pull/10036\nhttps://github.com/uutils/coreutils/commit/037b9583bc03d814e8516df54ebcda6f681fe1f8\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","enisa_id":"EUVD-2026-24988\n","aliases":"CVE-2026-35353\nGHSA-mj6p-44ch-cq69\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"a0906692-6ac1-35f5-9ffa-bd1c64acbcfc","vulnerability":{"id":"CVE-2026-35353","description":"The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically 0755) before subsequently changing them to the requested mode via a separate chmod system call. In multi-user environments, this introduces a brief window where a directory intended to be private is accessible to other users, potentially leading to unauthorized data access.","datePublished":"Apr 22, 2026, 4:08:09 PM","dateUpdated":"Apr 22, 2026, 5:49:45 PM","status":"PUBLISHED","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/uutils/coreutils/pull/10036\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","enisa_id":"EUVD-2026-24988\n","assigner":"canonical","epss":0.1,"dataProcessed":"Oct 27, 2026, 7:19:10 AM","vulnerabilityProduct":[{"id":"70bfefb7-76a3-3dcc-9743-e4dc5a5f3e27","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.6.0"}],"vulnerabilityVendor":[{"id":"12eefd76-0df1-3982-951e-379360a677af","vendor":{"name":"Uutils"}}]}},{"id":"b222fd59-84f5-3ba9-8090-8862212a024d","vulnerability":{"id":"GHSA-vf87-345h-9qhx","description":"Duplicate Advisory: uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition","datePublished":"Apr 22, 2026, 6:31:45 PM","dateUpdated":"Jul 6, 2026, 8:16:07 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-35353\nhttps://github.com/uutils/coreutils/pull/10036\nhttps://github.com/uutils/coreutils/commit/037b9583bc03d814e8516df54ebcda6f681fe1f8\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","enisa_id":"EUVD-2026-24988\n","aliases":"GHSA-vf87-345h-9qhx\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}