CVE-2026-35351

The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.

CVSS v3 4.2 MEDIUM

4.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/uutils/coreutils/issues/9714	Exploit Issue Tracking Vendor Advisory
https://github.com/uutils/coreutils/issues/9714	Exploit Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) La utilidad mv en uutils coreutils falla en preservar la propiedad de los archivos al moverlos entre diferentes límites de sistemas de archivos. La utilidad recurre a una rutina de copiar y eliminar que crea el archivo de destino utilizando el UID/GID del llamador en lugar de los metadatos de origen. Esta falla rompe las copias de seguridad y las migraciones, haciendo que los archivos movidos por un usuario privilegiado (por ejemplo, root) se conviertan inesperadamente en propiedad de root, lo que puede llevar a la revelación de información o a un acceso restringido para los propietarios previstos.

Information

Published : 2026-04-22 17:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-35351

Mitre link : CVE-2026-35351

CVE.ORG link : CVE-2026-35351

JSON object : View

Products Affected

uutils

coreutils

CWE

CWE-281

Improper Preservation of Permissions

{"id": "CVE-2026-35351", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35351", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T18:05:13.192722Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 0.8}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/uutils/coreutils", "vendor": "Uutils", "product": "coreutils", "platforms": ["Linux", "Unix", "macOS"], "packageName": "coreutils", "collectionURL": "https://github.com/uutils", "defaultStatus": "affected"}]}], "published": "2026-04-22T17:16:37.457", "references": [{"url": "https://github.com/uutils/coreutils/issues/9714", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "security@ubuntu.com"}, {"url": "https://github.com/uutils/coreutils/issues/9714", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-281"}]}], "descriptions": [{"lang": "en", "value": "The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners."}, {"lang": "es", "value": "La utilidad mv en uutils coreutils falla en preservar la propiedad de los archivos al moverlos entre diferentes l\u00edmites de sistemas de archivos. La utilidad recurre a una rutina de copiar y eliminar que crea el archivo de destino utilizando el UID/GID del llamador en lugar de los metadatos de origen. Esta falla rompe las copias de seguridad y las migraciones, haciendo que los archivos movidos por un usuario privilegiado (por ejemplo, root) se conviertan inesperadamente en propiedad de root, lo que puede llevar a la revelaci\u00f3n de informaci\u00f3n o a un acceso restringido para los propietarios previstos."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "4A9AF9E4-E17C-48AD-8051-B49998618839"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}