Executive brief
A vulnerability in the Rust-based uutils coreutils package could allow users to bypass safety protections intended to prevent accidental or malicious modification of the system's root directory. The 'chmod' utility, which manages file permissions, fails to properly recognize the root directory when it is referenced using alternative path names like "/../" or symbolic links. If exploited, this could lead to a complete system breakdown by stripping essential permissions from every file on the server.
Technical details
A path traversal vulnerability (CWE-22) exists in the chmod utility of uutils coreutils due to improper path validation. The implementation of the --preserve-root safety mechanism only checks if the target path is literally '/', failing to canonicalize the path before comparison. A local attacker or an accidental user can bypass this check by using path variants such as '/../' or symbolic links that resolve to the root directory. This allows the execution of destructive recursive operations (e.g., chmod -R 000 /../) across the entire root filesystem. The issue is fixed in version 0.6.0 by ensuring paths are properly resolved before the safety check.
Affected products
- uutils coreutils (Rust) < 0.6.0
Timeline
- 2026-01-07: patched: Fix merged into main branch
- 2026-02-02: advisory: Release 0.6.0 published
- 2026-04-22: disclosed: CVE-2026-35338 published
- 2026-07-06: other: Advisory GHSA-9gqx-53gp-c8g3 withdrawn as duplicate of GHSA-4c7q-4928-8445