This vulnerability in uutils coreutils' rm utility involves improper limitation of a pathname to a restricted directory (CWE-22). While safeguards prevent deletion of '.' or '..', the utility does not correctly handle equivalent paths with trailing slashes, allowing bypass of these protections. The command 'rm -rf ./' recursively deletes all files in the current directory without proper warning, and the misleading error message obscures the impact. The CVSS 3.1 score is 5.6 (medium severity) with local attack vector, low complexity, requiring low privileges and user interaction, impacting integrity and availability.

Successful exploitation results in unintended recursive deletion of all contents in the current directory, causing data loss (integrity and availability impact). The misleading error message may delay user awareness and response, increasing potential damage. There is no indication of confidentiality impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using 'rm -rf' with paths that include trailing slashes equivalent to '.' or '..'. Careful command usage and validation of input paths can help mitigate accidental data loss.