CVE-2026-35339: uutils coreutils incorrect exit code in chmod recursive mode

CVE-2026-35339 · Severity: medium · CVSS 5.5 · Published 2026-07-06

Executive brief

The 'chmod' utility in the uutils coreutils package (a Rust-based alternative to standard Linux tools) contains a bug where it may incorrectly report success when changing file permissions. When processing multiple files or directories recursively, the tool only reports the status of the very last file it touched; if earlier files failed to update due to permission errors, the tool still returns a 'success' code. This can lead to security risks where automated scripts assume permissions were tightened correctly when they actually remained unchanged, potentially leaving sensitive data exposed.

Technical details

A vulnerability exists in the `Chmoder::chmod()` function of `uu_chmod` where the recursive processing branch overwrites the running result variable instead of accumulating errors. Specifically, the logic uses a 'last-file-wins' approach for the exit status during directory traversal. An attacker or a misconfigured environment could result in some files failing to receive new permission bits (e.g., due to 'Operation not permitted'), while the utility returns an exit code of 0 to the calling shell. This is a violation of expected POSIX/GNU behavior where any failure should result in a non-zero exit code. This impacts the integrity of access control configurations in automated deployment or hardening scripts. The issue is fixed in version 0.6.0 by ensuring errors are accumulated during traversal.

Affected products

uutils coreutils (uu_chmod) < 0.6.0

Timeline

2025-12-23: other: Pull request submitted to fix the issue
2026-01-01: patched: Fix merged into main branch
2026-01-20: disclosed: Vulnerability reported by Zellic in security assessment
2026-02-02: other: Version 0.6.0 released
2026-07-06: advisory: GitHub Advisory published

References

Related threats

uutils coreutils chmod --preserve-root bypass via non-canonical paths