CVE-2026-35349: uutils coreutils protection bypass via symlink in rm --preserve-root

CVE-2026-35349 · Severity: medium · CVSS 6.7 · Published 2026-04-22

A vulnerability in the 'rm' utility of the Rust-based uutils coreutils allows users to bypass the safety mechanism intended to prevent accidental deletion of the system's root directory. By using a symbolic link that points to the root directory, the tool fails to recognize it is operating on the system core, potentially leading to the unintended deletion of the entire filesystem. This could result in a complete system failure or loss of all hosted data if executed with sufficient permissions.

Technologies: Uutils Coreutils. Vendors: crates.io, Uutils.

Quick answers

Is CVE-2026-35349 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-35349 being exploited in the wild.
How severe is CVE-2026-35349?
Medium severity, with a CVSS score of 6.7, published 22 April 2026.
Which products and versions are affected?
uu_rm (crates.io) < 0.7.0, SEMVER:introduced=0,fixed=0.7.0.
Is there a fix for CVE-2026-35349?
Yes. uu_rm (crates.io): upgrade to 0.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-35349 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-35349?
Check whether you run uu_rm (crates.io) or Uutils Coreutils at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • uu_rm (crates.io): upgrade to 0.7.0 or later
    cargo update -p uu_rm

Technical details

The 'rm' utility in uutils coreutils (uu_rm) implements the '--preserve-root' protection using a path-string check (path.has_root() && path.parent().is_none()) instead of comparing device and inode numbers. Because a symbolic link pointing to '/' (e.g., /tmp/rootlink -> /) contains a parent component in its path string, it bypasses the string-based check. An attacker or user can trigger a recursive deletion of the root filesystem by targeting such a symlink. The vulnerability was fixed in version 0.7.0 by implementing a check that compares the device/inode of traversed directories against the cached metadata of the root directory.

Affected products

  • uutils coreutils (uu_rm) < 0.7.0

Identifiers

  • CVE-2026-35349
  • GHSA-7cr3-h577-g38j

Timeline

  • 2025-12-18: other: Initial pull request submitted
  • 2026-01-20: disclosed: Reported by Zellic in security assessment
  • 2026-02-05: patched: Fix merged into main branch
  • 2026-05-30: advisory: GitHub Advisory published
  • 2026-07-06: other: Advisory updated and reviewed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.