{"id":"EUVD-2026-25006","enisaUuid":"5c3c0fd1-c319-3e5a-aab5-151f055ee004","description":"The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.","datePublished":"Apr 22, 2026, 4:08:33 PM","dateUpdated":"Apr 22, 2026, 5:28:40 PM","baseScore":3.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/uutils/coreutils/pull/9792\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","aliases":"CVE-2026-35362\nGHSA-w6xc-g9qj-vp32\n","assigner":"canonical","epss":0.18,"enisaIdProduct":[{"id":"d643295e-3101-3ec8-8830-a431624e9697","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.6.0"}],"enisaIdVendor":[{"id":"4a973ea7-4460-3457-91b5-9b6a0bcb8a13","vendor":{"name":"Uutils"}}],"enisaIdVulnerability":[{"id":"27a9bd00-c933-3aa0-9339-7ead512d0988","vulnerability":{"id":"GHSA-w6xc-g9qj-vp32","description":"uucore: safe_traversal TOCTOU protection only enabled on Linux","datePublished":"Jul 6, 2026, 8:25:15 PM","dateUpdated":"Jul 6, 2026, 8:25:15 PM","baseScore":0.0,"references":"https://github.com/uutils/coreutils/security/advisories/GHSA-w6xc-g9qj-vp32\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35362\nhttps://github.com/uutils/coreutils/pull/9792\nhttps://github.com/uutils/coreutils/commit/30239e69a328e76d2377f2a0bc02fbde61c34280\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","enisa_id":"EUVD-2026-25006\n","aliases":"CVE-2026-35362\nGHSA-w6xc-g9qj-vp32\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"8276f175-c60b-3aba-bc23-8dfce97499e6","vulnerability":{"id":"CVE-2026-35362","description":"The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.","datePublished":"Apr 22, 2026, 4:08:33 PM","dateUpdated":"Apr 22, 2026, 5:28:40 PM","status":"PUBLISHED","baseScore":3.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/uutils/coreutils/pull/9792\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","enisa_id":"EUVD-2026-25006\n","assigner":"canonical","epss":0.18,"dataProcessed":"Oct 27, 2026, 7:19:10 AM","vulnerabilityProduct":[{"id":"39230374-5910-3cf2-8e5c-61d73cb09574","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.6.0"}],"vulnerabilityVendor":[{"id":"f2d5a241-b884-3455-b83f-bf740ab9b91b","vendor":{"name":"Uutils"}}]}},{"id":"e6bb6386-3f0c-11f1-8640-7ced8d12c988","vulnerability":{"id":"GHSA-ggc5-46rg-mr4v","description":"Duplicate Advisory: uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition","datePublished":"Apr 22, 2026, 6:31:45 PM","dateUpdated":"Jul 6, 2026, 8:25:08 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-35362\nhttps://github.com/uutils/coreutils/pull/9792\nhttps://github.com/uutils/coreutils/commit/30239e69a328e76d2377f2a0bc02fbde61c34280\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.6.0\n","enisa_id":"EUVD-2026-25006\n","aliases":"GHSA-ggc5-46rg-mr4v\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}