{"id":"EUVD-2026-25008","revision":"78609421bbdd4fe9b305549061cf93e6","records":[{"revision":"78609421bbdd4fe9b305549061cf93e6","observedAt":"2026-10-28T04:55:18.804+00:00","statement":{"source":"euvd","id":"EUVD-2026-25008","aliases":["CVE-2026-35363","GHSA-89p7-7cq3-hhr2"],"title":"A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with tr…","description":"A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading 'Invalid input' error, which may cause users to miss the critical window for data recovery.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L","score":5.6,"severity":null}],"references":["https://github.com/uutils/coreutils/issues/9749"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-25008","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 22, 2026, 4:08:36 PM","dateUpdated":"Apr 22, 2026, 5:24:11 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-25008","identifiers":["EUVD-2026-25008","CVE-2026-35363","GHSA-89p7-7cq3-hhr2"]},"retained":false,"historicalAffected":[]}],"coverage":[]}