{"id":"EUVD-2026-24992","enisaUuid":"519f05ea-bab2-356b-ae6c-df5dcbbbe390","description":"The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation. The implementation unlinks an existing destination file and then recreates it using a path-based operation without the O_EXCL flag. A local attacker can exploit the window between the unlink and the subsequent creation to swap the path with a symbolic link, allowing them to redirect privileged writes to overwrite arbitrary system files.","datePublished":"Apr 22, 2026, 4:08:14 PM","dateUpdated":"Apr 22, 2026, 6:01:47 PM","baseScore":6.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/uutils/coreutils/pull/10067\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","aliases":"CVE-2026-35355\nGHSA-239g-2685-54x3\n","assigner":"canonical","epss":0.12,"enisaIdProduct":[{"id":"b2881589-bdaf-36ee-b469-7d5019de9187","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.6.0"}],"enisaIdVendor":[{"id":"c1c9cf09-9ff5-3231-bf8a-d439c3700508","vendor":{"name":"Uutils"}}],"enisaIdVulnerability":[{"id":"2576c448-2f96-3c97-8dee-cc4b8045ff41","vulnerability":{"id":"GHSA-v24v-f45g-w7jf","description":"Duplicate Advisory: uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition","datePublished":"Apr 22, 2026, 6:31:45 PM","dateUpdated":"Jul 6, 2026, 7:54:01 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-35355\nhttps://github.com/uutils/coreutils/pull/10067\nhttps://github.com/uutils/coreutils/commit/b5bbabc18a1121908848d836f869a4e98eb63886\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","enisa_id":"EUVD-2026-24992\n","aliases":"GHSA-v24v-f45g-w7jf\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"506d8a8b-1f23-31d6-8997-a8ba7cdc0420","vulnerability":{"id":"CVE-2026-35355","description":"The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file installation. The implementation unlinks an existing destination file and then recreates it using a path-based operation without the O_EXCL flag. A local attacker can exploit the window between the unlink and the subsequent creation to swap the path with a symbolic link, allowing them to redirect privileged writes to overwrite arbitrary system files.","datePublished":"Apr 22, 2026, 4:08:14 PM","dateUpdated":"Apr 22, 2026, 6:01:47 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/uutils/coreutils/pull/10067\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","enisa_id":"EUVD-2026-24992\n","assigner":"canonical","epss":0.12,"dataProcessed":"Oct 27, 2026, 7:19:10 AM","vulnerabilityProduct":[{"id":"1552da12-2b7a-3d24-8e0b-348ef9133389","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.6.0"}],"vulnerabilityVendor":[{"id":"d9ee15ea-7c98-3529-965e-81f0cbb55d08","vendor":{"name":"Uutils"}}]}},{"id":"df421ab7-3bd3-351f-a544-bd017cc31e68","vulnerability":{"id":"GHSA-239g-2685-54x3","description":"install: TOCTOU symlink race (unlink-then-create without O_EXCL) allows arbitrary file overwrite","datePublished":"Jul 6, 2026, 7:54:08 PM","dateUpdated":"Jul 6, 2026, 7:54:08 PM","baseScore":0.0,"references":"https://github.com/uutils/coreutils/security/advisories/GHSA-239g-2685-54x3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35355\nhttps://github.com/uutils/coreutils/pull/10067\nhttps://github.com/uutils/coreutils/commit/b5bbabc18a1121908848d836f869a4e98eb63886\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","enisa_id":"EUVD-2026-24992\n","aliases":"GHSA-239g-2685-54x3\nCVE-2026-35355\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}