The vulnerability in Uutils coreutils' cp utility is a TOCTOU race condition (CWE-367) where the program first checks if a source path is a symbolic link but then opens the file without the O_NOFOLLOW flag. This gap allows an attacker with concurrent write access to replace the checked file with a symbolic link pointing to arbitrary sensitive files. Consequently, a privileged cp process may inadvertently copy sensitive file contents to an attacker-controlled destination. The CVSS 3.1 vector indicates the attack requires local access with high attack complexity and low privileges, no user interaction, and impacts confidentiality but not integrity or availability.

The vulnerability can lead to unauthorized disclosure of sensitive file contents by tricking a privileged cp process into copying arbitrary files to attacker-controlled locations. This compromises confidentiality but does not affect integrity or availability. Exploitation requires local access with the ability to perform concurrent writes to the filesystem and is considered medium severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid running the vulnerable cp utility with elevated privileges in environments where untrusted users have concurrent write access to source paths. Consider using alternative tools that properly handle symbolic links or implement manual checks to prevent TOCTOU conditions.