The rm utility in uutils coreutils improperly limits pathnames to restricted directories, specifically failing to treat paths like ./ or ./// as equivalent to . or .., which it correctly refuses to delete. This allows bypassing safeguards that protect the current directory from deletion. Executing rm -rf ./ results in silent recursive deletion of all files and directories in the current directory, accompanied by a misleading error message that may obscure the data loss event. No patch or official remediation has been documented yet.

This vulnerability can lead to unintended or malicious recursive deletion of all contents in the current directory, causing data loss. The misleading error message may delay user awareness and response, increasing the risk of permanent data loss. There is no indication of confidentiality or integrity impact, but the availability impact is low to medium due to data deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using rm commands with paths that include trailing slashes equivalent to . or .., such as ./ or .///. Careful command usage and additional safeguards outside the utility may be necessary to prevent accidental data loss.