{"id":"EUVD-2026-24994","enisaUuid":"0e1f8675-35bd-3a8d-89df-14864a9844a9","description":"A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command creates parent directories and subsequently performs a second path resolution to create the target file, neither of which is anchored to a directory file descriptor. An attacker with concurrent write access can replace a path component with a symbolic link between these operations, redirecting the privileged write to an arbitrary file system location.","datePublished":"Apr 22, 2026, 4:08:17 PM","dateUpdated":"Apr 22, 2026, 6:00:14 PM","baseScore":6.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/uutils/coreutils/pull/10140\nhttps://github.com/uutils/coreutils/releases/tag/0.7.0\n","aliases":"CVE-2026-35356\nGHSA-gwm6-q8ch-hcfr\n","assigner":"canonical","epss":0.11,"enisaIdProduct":[{"id":"514534a2-f08a-34d1-ab13-0cc8808a1152","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.7.0"}],"enisaIdVendor":[{"id":"7b3ff8f1-8c6f-30a8-9847-20257339a813","vendor":{"name":"Uutils"}}],"enisaIdVulnerability":[{"id":"78a04473-b8b0-30b1-b084-98de066faf13","vulnerability":{"id":"CVE-2026-35356","description":"A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command creates parent directories and subsequently performs a second path resolution to create the target file, neither of which is anchored to a directory file descriptor. An attacker with concurrent write access can replace a path component with a symbolic link between these operations, redirecting the privileged write to an arbitrary file system location.","datePublished":"Apr 22, 2026, 4:08:17 PM","dateUpdated":"Apr 22, 2026, 6:00:14 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/uutils/coreutils/pull/10140\nhttps://github.com/uutils/coreutils/releases/tag/0.7.0\n","enisa_id":"EUVD-2026-24994\n","assigner":"canonical","epss":0.11,"dataProcessed":"Oct 27, 2026, 7:19:10 AM","vulnerabilityProduct":[{"id":"592fef4d-87dc-3c95-bab3-e3d207b628f7","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.7.0"}],"vulnerabilityVendor":[{"id":"e502e36a-3b28-34da-a3f3-8b2d8f46bf8e","vendor":{"name":"Uutils"}}]}},{"id":"99afd641-810f-310d-aa43-ec1055facac4","vulnerability":{"id":"GHSA-m26v-hjq3-x245","description":"Duplicate Advisory: uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition","datePublished":"Apr 22, 2026, 6:31:45 PM","dateUpdated":"Jul 6, 2026, 7:54:51 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-35356\nhttps://github.com/uutils/coreutils/pull/10140\nhttps://github.com/uutils/coreutils/commit/0c41299975f3c1e21cf5ca968d42cad55ceb42a1\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.7.0\n","enisa_id":"EUVD-2026-24994\n","aliases":"GHSA-m26v-hjq3-x245\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b5959507-d246-3da8-a56d-00f332fed18c","vulnerability":{"id":"GHSA-gwm6-q8ch-hcfr","description":"install -D: symlink race in directory creation allows arbitrary file overwrite","datePublished":"Jul 6, 2026, 7:54:56 PM","dateUpdated":"Jul 6, 2026, 7:54:56 PM","baseScore":0.0,"references":"https://github.com/uutils/coreutils/security/advisories/GHSA-gwm6-q8ch-hcfr\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35356\nhttps://github.com/uutils/coreutils/pull/10140\nhttps://github.com/uutils/coreutils/commit/0c41299975f3c1e21cf5ca968d42cad55ceb42a1\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.7.0\n","enisa_id":"EUVD-2026-24994\n","aliases":"GHSA-gwm6-q8ch-hcfr\nCVE-2026-35356\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}