CVE-2026-35339: fallo de gravedad media en Uutils coreutils
uutils coreutils chmod False Success Exit Code in Recursive Mode
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.5epss 0.1%
The recursive mode (-R) of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple files. The final return value is determined solely by the success or failure of the last file processed. This allows the command to return an exit code of 0 (success) even if errors were encountered on previous files, such as 'Operation not permitted'. Scripts relying on these exit codes may proceed under a false sense of success while sensitive files remain with restrictive or incorrect permissions.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Productos afectados
Uutils · coreutilsCVEs relacionadas — Uutils coreutils
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-35349MEDIUMuutils coreutils Path-Based Safety Bypass with --preserve-rootEPSS 0.2%CVE-2026-35381LOWuutils coreutils cut Local Logic Error and Data Integrity Issue in Output FilteringEPSS 0.2%CVE-2026-35362LOWuutils coreutils Missing TOCTOU Protection on Non-Linux Unix Platforms in Safe Traversal ModuleEPSS 0.2%CVE-2026-35358MEDIUMuutils coreutils cp Semantic Loss and Potential Denial of Service with -R via Device Node Stream ReadingEPSS 0.2%CVE-2026-35346LOWuutils coreutils comm Silent Data Corruption via Lossy UTF-8 NormalizationEPSS 0.2%CVE-2026-35338HIGHuutils coreutils chmod Path Traversal Bypass of --preserve-rootEPSS 0.2%