CVE-2026-35345

A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link's target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.0 / Impact : 4.2

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/uutils/coreutils/issues/10328	Exploit Issue Tracking
https://github.com/uutils/coreutils/issues/10328	Exploit Issue Tracking

Configurations

Configuration 1 (hide)

cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad en la utilidad tail de uutils coreutils permite la exfiltración de contenidos de archivos sensibles al usar la opción --follow=name. A diferencia de GNU tail, la implementación de uutils continúa monitorizando una ruta después de que ha sido reemplazada por un enlace simbólico, mostrando posteriormente los contenidos del objetivo del enlace. En entornos donde un usuario privilegiado (p. ej., root) monitoriza un directorio de registros, un atacante local con acceso de escritura a ese directorio puede reemplazar un archivo de registro con un enlace simbólico a un archivo de sistema sensible (como /etc/sha4dow), haciendo que tail divulgue los contenidos del archivo sensible.

Information

Published : 2026-04-22 17:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-35345

Mitre link : CVE-2026-35345

CVE.ORG link : CVE-2026-35345

JSON object : View

Products Affected

uutils

coreutils

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

{"id": "CVE-2026-35345", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35345", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T18:13:16.337487Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 1.0}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/uutils/coreutils", "vendor": "Uutils", "product": "coreutils", "platforms": ["Linux", "Unix", "macOS"], "packageName": "coreutils", "collectionURL": "https://github.com/uutils", "defaultStatus": "affected"}]}], "published": "2026-04-22T17:16:36.627", "references": [{"url": "https://github.com/uutils/coreutils/issues/10328", "tags": ["Exploit", "Issue Tracking"], "source": "security@ubuntu.com"}, {"url": "https://github.com/uutils/coreutils/issues/10328", "tags": ["Exploit", "Issue Tracking"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-59"}, {"lang": "en", "value": "CWE-367"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link's target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file."}, {"lang": "es", "value": "Una vulnerabilidad en la utilidad tail de uutils coreutils permite la exfiltraci\u00f3n de contenidos de archivos sensibles al usar la opci\u00f3n --follow=name. A diferencia de GNU tail, la implementaci\u00f3n de uutils contin\u00faa monitorizando una ruta despu\u00e9s de que ha sido reemplazada por un enlace simb\u00f3lico, mostrando posteriormente los contenidos del objetivo del enlace. En entornos donde un usuario privilegiado (p. ej., root) monitoriza un directorio de registros, un atacante local con acceso de escritura a ese directorio puede reemplazar un archivo de registro con un enlace simb\u00f3lico a un archivo de sistema sensible (como /etc/sha4dow), haciendo que tail divulgue los contenidos del archivo sensible."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "4A9AF9E4-E17C-48AD-8051-B49998618839"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}