The uutils coreutils install utility (versions prior to 0.7.0) contains a TOCTOU race condition triggered by the use of the -D flag. The process involves creating parent directories followed by a second path resolution to create the target file, neither operation anchored to a directory file descriptor. An attacker with concurrent write access can exploit the window between these operations to replace a path component with a symbolic link, causing privileged writes to be redirected to unintended filesystem locations. This vulnerability is classified under CWE-367 (Time-of-Check to Time-of-Use Race Condition). The advisory is marked as a duplicate and withdrawn, referencing GHSA-gwm6-q8ch-hcfr for the original report.

Exploitation of this TOCTOU vulnerability can lead to unauthorized redirection of privileged file writes to arbitrary locations, potentially allowing an attacker to overwrite critical files or escalate privileges. The CVSS 3.1 vector indicates low attack vector (local), high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory GHSA-gwm6-q8ch-hcfr for current remediation guidance. Since this advisory is a duplicate and withdrawn, refer to the original advisory for official fixes or mitigation steps. Until a fix is applied, avoid using the -D flag in untrusted or concurrent environments to reduce risk.