The vulnerability in uutils coreutils ln utility arises from a logic error that causes the utility to dereference symbolic links even when the --no-dereference (-n) flag is specified, but only if --force is not also used. This results in ln following a symlink that points to a directory and creating new links inside that directory rather than treating the symlink as the destination. This behavior can be exploited by a local attacker to manipulate file creation paths in privileged contexts, potentially causing unauthorized file creation or system misconfiguration. The issue is tracked as CWE-61 (Improper Handling of Symbolic Links). The vulnerability affects version 0 of the product, was published on 2026-04-22, and currently has no known exploits in the wild or vendor-provided patches.

The impact is limited to local attackers who can manipulate existing symbolic links to cause privileged users or system scripts using ln -n to create files or links inside unintended directories. This can lead to unauthorized file creation or system misconfiguration. There is no direct confidentiality or availability impact reported. The CVSS vector indicates low attack complexity and low privileges required but user interaction is needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using ln with the --no-dereference (-n) flag in privileged scripts or environments where symbolic links could be manipulated by untrusted users. Consider additional access controls on symbolic links and directories to limit local attacker influence.