{"id":"EUVD-2026-25020","enisaUuid":"97b86ddb-5fea-3a22-ad22-1518e4108820","description":"A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target even when the --no-dereference (or -n) flag is explicitly provided. The implementation previously only honored the \"no-dereference\" intent if the --force (overwrite) mode was also enabled. This flaw causes ln to follow a symbolic link that points to a directory and create new links inside that target directory instead of treating the symbolic link itself as the destination. In environments where a privileged user or system script uses ln -n to update a symlink, a local attacker could manipulate existing symbolic links to redirect file creation into sensitive directories, potentially leading to unauthorized file creation or system misconfiguration.","datePublished":"Apr 22, 2026, 4:08:58 PM","dateUpdated":"Apr 22, 2026, 5:21:15 PM","baseScore":5.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","references":"https://github.com/uutils/coreutils/pull/11253\nhttps://github.com/uutils/coreutils/releases/tag/0.8.0\n","aliases":"CVE-2026-35372\n","assigner":"canonical","epss":0.14,"enisaIdProduct":[{"id":"b8db7e87-d0ce-3cbc-9818-bfb7950dab0d","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.8.0"}],"enisaIdVendor":[{"id":"299f4c05-875a-34a2-9bd9-083ad209be1a","vendor":{"name":"Uutils"}}],"enisaIdVulnerability":[{"id":"129c73d3-6d25-3a2d-b7a0-3ab6e1f634d6","vulnerability":{"id":"GHSA-wq63-vh5h-pr5p","description":"uutils coreutils has a UNIX Symbolic Link (Symlink) Following issue","datePublished":"Apr 22, 2026, 6:31:46 PM","dateUpdated":"Apr 30, 2026, 5:53:37 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-35372\nhttps://github.com/uutils/coreutils/pull/11253\nhttps://github.com/uutils/coreutils/commit/394c4b17f2f382b4be9f54389bcb79028de02f39\nhttps://github.com/uutils/coreutils\nhttps://github.com/uutils/coreutils/releases/tag/0.8.0\n","enisa_id":"EUVD-2026-25020\n","aliases":"GHSA-wq63-vh5h-pr5p\nCVE-2026-35372\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"2e8bb65f-6a1d-3769-8bd2-0559654782e7","vulnerability":{"id":"CVE-2026-35372","description":"A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target even when the --no-dereference (or -n) flag is explicitly provided. The implementation previously only honored the \"no-dereference\" intent if the --force (overwrite) mode was also enabled. This flaw causes ln to follow a symbolic link that points to a directory and create new links inside that target directory instead of treating the symbolic link itself as the destination. In environments where a privileged user or system script uses ln -n to update a symlink, a local attacker could manipulate existing symbolic links to redirect file creation into sensitive directories, potentially leading to unauthorized file creation or system misconfiguration.","datePublished":"Apr 22, 2026, 4:08:58 PM","dateUpdated":"Apr 22, 2026, 5:21:15 PM","status":"PUBLISHED","baseScore":5.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","references":"https://github.com/uutils/coreutils/pull/11253\nhttps://github.com/uutils/coreutils/releases/tag/0.8.0\n","enisa_id":"EUVD-2026-25020\n","assigner":"canonical","epss":0.14,"dataProcessed":"Oct 27, 2026, 7:19:10 AM","vulnerabilityProduct":[{"id":"e52f8d71-5d0f-39d4-9a88-6021e90cc94c","product":{"name":"coreutils","vendor":{"name":"Uutils"}},"product_version":"0 \u003c0.8.0"}],"vulnerabilityVendor":[{"id":"a3fbfdad-9e9e-33a5-abc8-22d9898b3cc3","vendor":{"name":"Uutils"}}]}}],"enisaIdAdvisory":[]}