Executive brief
A vulnerability in the 'rm' utility of uutils coreutils—a Rust-based implementation of standard system commands—can lead to accidental or malicious data loss. The tool fails to properly block deletion requests for the current directory when they are formatted with trailing slashes (e.g., './'). This can result in the silent, permanent deletion of all files in the current folder while displaying a misleading error message that hides the extent of the damage.
Technical details
A path traversal/validation vulnerability (CWE-22) exists in the 'rm' utility of uutils coreutils. While the utility contains logic to refuse deletion of '.' or '..', it fails to normalize or correctly identify equivalent paths containing trailing slashes, such as './' or './//'. An attacker or an accidental user command (e.g., 'rm -rf ./') triggers a recursive deletion of the current directory's contents. The utility then returns a misleading 'Invalid input' error, which may prevent users from realizing data loss has occurred in time to attempt recovery. This affects versions up to and including 0.8.0.
Affected products
- uutils coreutils <= 0.8.0
Timeline
- 2025-12-20: disclosed: Issue first reported on GitHub
- 2026-04-22: advisory: Initial GHSA and NVD publication
- 2026-07-06: other: Advisory withdrawn as a duplicate of GHSA-89p7-7cq3-hhr2