This vulnerability in uutils coreutils' install utility involves a TOCTOU race condition triggered by the use of the -D flag. The process first creates parent directories and then performs a second path resolution to create the target file. Because neither operation is anchored to a directory file descriptor, an attacker with concurrent write access can exploit the time gap between these operations to replace a path component with a symbolic link. This redirection can cause privileged writes to be performed on arbitrary filesystem locations, potentially leading to unauthorized file modifications or privilege escalation. No official patch or remediation level has been provided at this time.

The vulnerability allows an attacker with concurrent write access to manipulate the filesystem path between directory creation and file creation steps, causing privileged writes to be redirected to arbitrary locations. This can lead to unauthorized modification of files, potentially impacting system integrity and availability. The CVSS score of 6.3 reflects a medium severity with high impact on integrity and availability, but requiring local access with high attack complexity and low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the install utility with the -D flag in untrusted or multi-user environments where concurrent write access by attackers is possible. Monitor vendor communications for updates on patches or official mitigations.