{"id":"EUVD-2026-25010","enisaUuid":"4c650601-1a5a-30d4-b0f6-214e3ce14371","description":"A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation. A local attacker with write access to the destination directory can exploit this window to replace the destination with a symbolic link. The subsequent privileged move operation will follow the symlink, allowing the attacker to redirect the write and overwrite an arbitrary target file with contents from the source.","datePublished":"Apr 22, 2026, 4:08:38 PM","dateUpdated":"Apr 22, 2026, 5:22:25 PM","baseScore":6.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/uutils/coreutils/issues/10015\n","aliases":"CVE-2026-35364\n","assigner":"canonical","epss":0.09,"enisaIdProduct":[],"enisaIdVendor":[],"enisaIdVulnerability":[{"id":"68e67f54-026a-3d2d-a819-27257357cc89","vulnerability":{"id":"GHSA-m976-87wm-48fm","description":"uutils coreutils has a Time-of-check Time-of-use (TOCTOU) Race Condition","datePublished":"Apr 22, 2026, 6:31:45 PM","dateUpdated":"Apr 30, 2026, 5:31:35 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-35364\nhttps://github.com/uutils/coreutils/issues/10015\nhttps://github.com/uutils/coreutils\n","enisa_id":"EUVD-2026-25010\n","aliases":"CVE-2026-35364\nGHSA-m976-87wm-48fm\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"7ec050ec-cd2e-3be9-83e5-54ea79b585c5","vulnerability":{"id":"CVE-2026-35364","description":"A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it through a copy operation. A local attacker with write access to the destination directory can exploit this window to replace the destination with a symbolic link. The subsequent privileged move operation will follow the symlink, allowing the attacker to redirect the write and overwrite an arbitrary target file with contents from the source.","datePublished":"Apr 22, 2026, 4:08:38 PM","dateUpdated":"Apr 22, 2026, 5:22:25 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/uutils/coreutils/issues/10015\n","enisa_id":"EUVD-2026-25010\n","assigner":"canonical","epss":0.09,"dataProcessed":"Oct 30, 2026, 7:18:58 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}