{"id":"EUVD-2026-25008","enisaUuid":"218c8a43-85da-3eca-b5d3-b070c7f65037","description":"A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading \u0027Invalid input\u0027 error, which may cause users to miss the critical window for data recovery.","datePublished":"Apr 22, 2026, 4:08:36 PM","dateUpdated":"Apr 22, 2026, 5:24:11 PM","baseScore":5.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","references":"https://github.com/uutils/coreutils/issues/9749\n","aliases":"CVE-2026-35363\nGHSA-89p7-7cq3-hhr2\n","assigner":"canonical","epss":0.17,"enisaIdProduct":[],"enisaIdVendor":[],"enisaIdVulnerability":[{"id":"073d15b3-e62a-3c45-9041-f6c274f57298","vulnerability":{"id":"GHSA-89p7-7cq3-hhr2","description":"rm: \u0027rm -rf ./\u0027 (and ./// variants) silently deletes current directory contents, bypassing dot protection","datePublished":"Jul 6, 2026, 8:20:56 PM","dateUpdated":"Jul 6, 2026, 8:20:56 PM","baseScore":0.0,"references":"https://github.com/uutils/coreutils/security/advisories/GHSA-89p7-7cq3-hhr2\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-35363\nhttps://github.com/uutils/coreutils/issues/9749\nhttps://github.com/uutils/coreutils\n","enisa_id":"EUVD-2026-25008\n","aliases":"CVE-2026-35363\nGHSA-89p7-7cq3-hhr2\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"36c6ca34-ca78-3449-a00d-07bb3c89cb5a","vulnerability":{"id":"CVE-2026-35363","description":"A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading \u0027Invalid input\u0027 error, which may cause users to miss the critical window for data recovery.","datePublished":"Apr 22, 2026, 4:08:36 PM","dateUpdated":"Apr 22, 2026, 5:24:11 PM","status":"PUBLISHED","baseScore":5.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","references":"https://github.com/uutils/coreutils/issues/9749\n","enisa_id":"EUVD-2026-25008\n","assigner":"canonical","epss":0.17,"dataProcessed":"Oct 27, 2026, 7:19:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b2cd2116-3f06-11f1-8640-7ced8d12c988","vulnerability":{"id":"GHSA-vchc-9ggh-3236","description":"Duplicate Advisory: uutils coreutils has a Path Traversal issue","datePublished":"Apr 22, 2026, 6:31:45 PM","dateUpdated":"Jul 6, 2026, 8:20:49 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-35363\nhttps://github.com/uutils/coreutils/issues/9749\nhttps://github.com/uutils/coreutils\n","enisa_id":"EUVD-2026-25008\n","aliases":"GHSA-vchc-9ggh-3236\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}