{"id":"EUVD-2026-25002","enisaUuid":"8c772018-eb87-3ee5-8f07-f25ceeae98ca","description":"The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the utility identifies a missing path, it later attempts creation using File::create(), which internally uses O_TRUNC. An attacker can exploit this window to create a file or swap a symlink at the target path, causing touch to truncate an existing file and leading to permanent data loss.","datePublished":"Apr 22, 2026, 4:08:28 PM","dateUpdated":"Apr 22, 2026, 6:03:26 PM","baseScore":6.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/uutils/coreutils/issues/10019\n","aliases":"CVE-2026-35360\n","assigner":"canonical","epss":0.1,"enisaIdProduct":[],"enisaIdVendor":[],"enisaIdVulnerability":[{"id":"6383eeae-a85a-38ad-bb8a-df60461ead4f","vulnerability":{"id":"CVE-2026-35360","description":"The touch utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition during file creation. When the utility identifies a missing path, it later attempts creation using File::create(), which internally uses O_TRUNC. An attacker can exploit this window to create a file or swap a symlink at the target path, causing touch to truncate an existing file and leading to permanent data loss.","datePublished":"Apr 22, 2026, 4:08:28 PM","dateUpdated":"Apr 22, 2026, 6:03:26 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/uutils/coreutils/issues/10019\n","enisa_id":"EUVD-2026-25002\n","assigner":"canonical","epss":0.1,"dataProcessed":"Oct 27, 2026, 7:19:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"6f63b396-df5b-3b10-8481-5cfc779c8a90","vulnerability":{"id":"GHSA-q6m9-xj2w-xmrc","description":"uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition","datePublished":"Apr 22, 2026, 6:31:45 PM","dateUpdated":"Apr 30, 2026, 5:30:18 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-35360\nhttps://github.com/uutils/coreutils/issues/10019\nhttps://github.com/uutils/coreutils\n","enisa_id":"EUVD-2026-25002\n","aliases":"CVE-2026-35360\nGHSA-q6m9-xj2w-xmrc\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}