Junglewise Threat Intelligence

CVE-2026-35342: uutils coreutils insecure temporary file creation in mktemp

CVE-2026-35342 · Severity: low · CVSS 3.3 · Published 2026-07-06

Vendors: crates.io, Uutils.

Executive brief

The mktemp utility in uutils coreutils, a Rust-based alternative to standard GNU system tools, incorrectly handles empty environment variables when determining where to create temporary files. Instead of using the secure system temporary directory, it may create files in the user's current working directory. This could allow other users on the same system to access sensitive temporary data if the current directory has less restrictive security settings than the standard system temporary folder.

Technical details

The mktemp utility in uutils coreutils (uu_mktemp) treats an empty string in the TMPDIR environment variable as a valid path rather than falling back to /tmp. This results in an Insecure Temporary File vulnerability (CWE-377) where files are created in the current working directory (CWD). An attacker with local access could potentially read or manipulate these files if the CWD has more permissive permissions than /tmp. The issue was identified in audited commit 3a07ffc and is resolved in version 0.6.0 by treating an empty TMPDIR as unset.

Affected products

  • uutils coreutils (uu_mktemp) < 0.6.0

Timeline

  • 2026-01-29: other: Pull request submitted to fix the issue
  • 2026-01-31: patched: Fix merged into main branch
  • 2026-02-02: other: Version 0.6.0 released
  • 2026-07-06: advisory: GitHub Advisory published

References