The rm utility in uutils coreutils versions up to 0.8.0 contains a path traversal issue where it does not properly handle equivalent current directory paths with trailing slashes. Although it blocks deletion of '.' and '..', it does not block './' or similar variants, allowing recursive deletion of the current directory's contents. The utility also reports a misleading error message, which may prevent timely user response to data loss. This vulnerability is categorized as CWE-22 (Path Traversal) and has a CVSS 3.1 vector indicating local attack complexity, low privileges required, user interaction needed, and impacts integrity and availability.

An attacker or user with local access and limited privileges can execute 'rm -rf ./' to recursively delete all files and directories in the current working directory. The misleading 'Invalid input' error message may cause the user to overlook the deletion, increasing the risk of significant data loss. There is no confidentiality impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using 'rm -rf' with paths that include trailing slashes referencing the current directory. Careful command usage and verification can help prevent accidental data loss.