CVE-2026-35339: falha de média gravidade em Uutils coreutils
uutils coreutils chmod False Success Exit Code in Recursive Mode
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.5epss 0.1%
The recursive mode (-R) of the chmod utility in uutils coreutils incorrectly handles exit codes when processing multiple files. The final return value is determined solely by the success or failure of the last file processed. This allows the command to return an exit code of 0 (success) even if errors were encountered on previous files, such as 'Operation not permitted'. Scripts relying on these exit codes may proceed under a false sense of success while sensitive files remain with restrictive or incorrect permissions.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
Uutils · coreutilsCVEs relacionadas — Uutils coreutils
No mesmo produto, das mais perigosas para as menos.
CVE-2026-35349MEDIUMuutils coreutils Path-Based Safety Bypass with --preserve-rootEPSS 0.2%CVE-2026-35381LOWuutils coreutils cut Local Logic Error and Data Integrity Issue in Output FilteringEPSS 0.2%CVE-2026-35362LOWuutils coreutils Missing TOCTOU Protection on Non-Linux Unix Platforms in Safe Traversal ModuleEPSS 0.2%CVE-2026-35358MEDIUMuutils coreutils cp Semantic Loss and Potential Denial of Service with -R via Device Node Stream ReadingEPSS 0.2%CVE-2026-35346LOWuutils coreutils comm Silent Data Corruption via Lossy UTF-8 NormalizationEPSS 0.2%CVE-2026-35338HIGHuutils coreutils chmod Path Traversal Bypass of --preserve-rootEPSS 0.2%