CVE-2026-35363

A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading 'Invalid input' error, which may cause users to miss the critical window for data recovery.

CVSS v3 5.6 MEDIUM

5.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.3 / Impact : 4.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/uutils/coreutils/issues/9749	Exploit Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad en la utilidad rm de uutils coreutils permite eludir los mecanismos de salvaguardia destinados a proteger el directorio actual. Si bien la utilidad se niega correctamente a eliminar . o .., no reconoce rutas equivalentes con barras diagonales finales, como ./ o .///. Una ejecución accidental o maliciosa de rm -rf ./ resulta en la eliminación recursiva silenciosa de todo el contenido dentro del directorio actual. El comando oculta aún más la pérdida de datos al informar un error engañoso de ’Invalid input’, lo que puede hacer que los usuarios pierdan la ventana crítica para la recuperación de datos.

Information

Published : 2026-04-22 17:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-35363

Mitre link : CVE-2026-35363

CVE.ORG link : CVE-2026-35363

JSON object : View

Products Affected

uutils

coreutils

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-35363", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35363", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T17:24:03.925303Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 1.3}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/uutils/coreutils", "vendor": "Uutils", "product": "coreutils", "platforms": ["Linux", "Unix", "macOS"], "packageName": "coreutils", "collectionURL": "https://github.com/uutils", "defaultStatus": "affected"}]}], "published": "2026-04-22T17:16:39.120", "references": [{"url": "https://github.com/uutils/coreutils/issues/9749", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "security@ubuntu.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading 'Invalid input' error, which may cause users to miss the critical window for data recovery."}, {"lang": "es", "value": "Una vulnerabilidad en la utilidad rm de uutils coreutils permite eludir los mecanismos de salvaguardia destinados a proteger el directorio actual. Si bien la utilidad se niega correctamente a eliminar . o .., no reconoce rutas equivalentes con barras diagonales finales, como ./ o .///. Una ejecuci\u00f3n accidental o maliciosa de rm -rf ./ resulta en la eliminaci\u00f3n recursiva silenciosa de todo el contenido dentro del directorio actual. El comando oculta a\u00fan m\u00e1s la p\u00e9rdida de datos al informar un error enga\u00f1oso de \u2019Invalid input\u2019, lo que puede hacer que los usuarios pierdan la ventana cr\u00edtica para la recuperaci\u00f3n de datos."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:uutils:coreutils:-:*:*:*:*:rust:*:*", "vulnerable": true, "matchCriteriaId": "4A9AF9E4-E17C-48AD-8051-B49998618839"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}