{"id":"EUVD-2026-25000","enisaUuid":"d4f51fcf-dda4-3748-984a-44e0d4c8b5de","description":"A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.","datePublished":"Apr 22, 2026, 4:08:25 PM","dateUpdated":"Apr 22, 2026, 5:50:54 PM","baseScore":4.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/uutils/coreutils/issues/10017\n","aliases":"CVE-2026-35359\n","assigner":"canonical","epss":0.13,"enisaIdProduct":[],"enisaIdVendor":[],"enisaIdVulnerability":[{"id":"ac277501-8c7a-3e41-b267-775e750edf40","vulnerability":{"id":"CVE-2026-35359","description":"A Time-of-Check to Time-of-Use (TOCTOU) vulnerability in the cp utility of uutils coreutils allows an attacker to bypass no-dereference intent. The utility checks if a source path is a symbolic link using path-based metadata but subsequently opens it without the O_NOFOLLOW flag. An attacker with concurrent write access can swap a regular file for a symbolic link during this window, causing a privileged cp process to copy the contents of arbitrary sensitive files into a destination controlled by the attacker.","datePublished":"Apr 22, 2026, 4:08:25 PM","dateUpdated":"Apr 22, 2026, 5:50:54 PM","status":"PUBLISHED","baseScore":4.7,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/uutils/coreutils/issues/10017\n","enisa_id":"EUVD-2026-25000\n","assigner":"canonical","epss":0.13,"dataProcessed":"Oct 27, 2026, 7:19:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b2cdb8d7-3f06-11f1-8640-7ced8d12c988","vulnerability":{"id":"GHSA-hpfw-mqm3-33jh","description":"uutils coreutils has a Link Following issue","datePublished":"Apr 22, 2026, 6:31:45 PM","dateUpdated":"Apr 30, 2026, 5:14:47 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-35359\nhttps://github.com/uutils/coreutils/issues/10017\nhttps://github.com/uutils/coreutils\n","enisa_id":"EUVD-2026-25000\n","aliases":"GHSA-hpfw-mqm3-33jh\nCVE-2026-35359\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}