{"id":"EUVD-2026-25015","enisaUuid":"cf7f6030-e3ce-3b1f-b634-e15b2a3a4f11","description":"The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644). In multi-user environments, this allows any user on the system to read the captured stdout/stderr output of a command, potentially exposing sensitive information. This behavior diverges from GNU coreutils, which creates nohup.out with owner-only (0600) permissions.","datePublished":"Apr 22, 2026, 4:08:46 PM","dateUpdated":"Apr 22, 2026, 5:49:29 PM","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/uutils/coreutils/issues/10021\n","aliases":"CVE-2026-35367\n","assigner":"canonical","epss":0.11,"enisaIdProduct":[],"enisaIdVendor":[],"enisaIdVulnerability":[{"id":"28d01b93-3064-3684-9b00-29c9887f3f5c","vulnerability":{"id":"GHSA-5hgf-628x-mcqf","description":"uutils coreutils has an Incorrect Permission Assignment for Critical Resource","datePublished":"Apr 22, 2026, 6:31:45 PM","dateUpdated":"Apr 30, 2026, 5:50:53 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-35367\nhttps://github.com/uutils/coreutils/issues/10021\nhttps://github.com/uutils/coreutils\n","enisa_id":"EUVD-2026-25015\n","aliases":"GHSA-5hgf-628x-mcqf\nCVE-2026-35367\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"71e75cae-ae1a-381c-bb32-1ed0a2d78c18","vulnerability":{"id":"CVE-2026-35367","description":"The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typically resulting in a world-readable file (0644). In multi-user environments, this allows any user on the system to read the captured stdout/stderr output of a command, potentially exposing sensitive information. This behavior diverges from GNU coreutils, which creates nohup.out with owner-only (0600) permissions.","datePublished":"Apr 22, 2026, 4:08:46 PM","dateUpdated":"Apr 22, 2026, 5:49:29 PM","status":"PUBLISHED","baseScore":3.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","references":"https://github.com/uutils/coreutils/issues/10021\n","enisa_id":"EUVD-2026-25015\n","assigner":"canonical","epss":0.11,"dataProcessed":"Oct 30, 2026, 7:18:58 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}