The safe_traversal module in uutils coreutils is designed to prevent TOCTOU symlink race conditions by using file-descriptor-relative syscalls. However, this protection is limited to Linux targets. On other Unix-like operating systems like macOS and FreeBSD, the module does not implement these protections, resulting in a TOCTOU race condition vulnerability during directory traversal operations. This could allow an attacker to exploit symlink races to potentially influence file system operations. The CVSS 3.1 base score is 3.6, reflecting low severity with limited impact and requiring local access with high attack complexity.

The vulnerability allows for a TOCTOU race condition in directory traversal on non-Linux Unix-like systems, potentially enabling an attacker with local access to exploit symlink races. The impact is limited to confidentiality and integrity with no availability impact, and the attack complexity is high. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround is currently available, users on affected Unix-like systems should monitor vendor communications for updates. Avoid running untrusted code with elevated privileges and consider limiting local access to trusted users until a fix is released.