CVE catalog

CVE-2026-35356

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command creates parent directories and subsequently performs a secon

[CVE catalog]

Severity
Medium · CVSS 6.3CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.11% · Oct 25, 2026

A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command creates parent directories and subsequently performs a second path resolution to create the target file, neither of which is anchored to a directory file descriptor. An attacker with concurrent write access can replace a path component with a symbolic link between these operations, redirecting the privileged write to an arbitrary file system location.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrust-coreutilssid0.12.0-1fixed
Debianrust-coreutilsforky0.12.0-1fixed
Debianrust-coreutilstrixie0.0.30-2vulnerable
Debianrust-coreutilsbookworm0.0.17-2vulnerable
Cperust-coreutilsNot reportedNot reportedvulnerable
CpecoreutilsNot reported0.7.0fixed
Ubunturust-coreutils24.040.0.20-1vulnerable
Ubunturust-coreutils24.040.0.22-1vulnerable
Ubunturust-coreutils24.040.0.23-1vulnerable
Ubunturust-coreutils24.040.0.23-2vulnerable
Ubunturust-coreutils24.040.0.23-3vulnerable
Ubunturust-coreutils24.040.0.24-1vulnerable
Ubunturust-coreutils24.040.0.24-2vulnerable
Ubunturust-coreutils25.100.0.30-1vulnerable
Ubunturust-coreutils25.100.0.30-2vulnerable
Ubunturust-coreutils25.100.0.30-2ubuntu2vulnerable
Ubunturust-coreutils25.100.1.0-0ubuntu1vulnerable
Ubunturust-coreutils25.100.1.0+git20250711.2ba3a33-0ubuntu1vulnerable
Ubunturust-coreutils25.100.1.0+git20250711.2ba3a33-0ubuntu2vulnerable
Ubunturust-coreutils25.100.1.0+git20250711.2ba3a33-0ubuntu3vulnerable
Ubunturust-coreutils25.100.1.0+git20250711.2ba3a33-0ubuntu4vulnerable
Ubunturust-coreutils25.100.1.0+git20250801.cf79675-0ubuntu1vulnerable
Ubunturust-coreutils25.100.1.0+git20250813.4af2a84-0ubuntu2vulnerable
Ubunturust-coreutils25.100.1.0+git20250813.4af2a84-0ubuntu4vulnerable
Ubunturust-coreutils25.100.1.0+git20250813.4af2a84-0ubuntu6vulnerable
Ubunturust-coreutils25.100.1.0+git20250813.4af2a84-0ubuntu7vulnerable
Ubunturust-coreutils25.100.2.2-0ubuntu1vulnerable
Ubunturust-coreutils25.100.2.2-0ubuntu2vulnerable
Ubunturust-coreutils25.100.2.2-0ubuntu2.1vulnerable
CpecoreutilsNot reported0.7.0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrust-coreutilssourcesid0.7.0-1not yet assignedNot reportedNot reported
Debianrust-coreutilssourceforky0.7.0-1not yet assignedNot reportedNot reported
Debianrust-coreutilssourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianrust-coreutilssourcebookworm(unfixed)not yet assignedNot reportedNot reported
CpecoreutilscpeNot reported0.7.0Not reportedNot reportedNot reported
CpecoreutilscpeNot reported0.7.0Not reportedNVD-CVE-2026-35356Not reported

Notes

[trixie] rust-coreutils: Minor issue [bookworm] rust-coreutils: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [rust-coreutils]Affected
    Details (2)

    • 0.0.17-2 · amd64 · bookworm

      Affected

      nvd · rust-coreutils · debian · bookworm; nvd · rust-coreutils · debian · 12

    • 0.0.17-2 · arm64 · bookworm

      Affected

      nvd · rust-coreutils · debian · bookworm; nvd · rust-coreutils · debian · 12

[Debian 13 (Trixie)]

  • [rust-coreutils]Affected
    Details (2)

    • 0.0.30-2 · amd64 · trixie

      Affected

      nvd · rust-coreutils · debian · 13

    • 0.0.30-2 · arm64 · trixie

      Affected

      nvd · rust-coreutils · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]