Uutils vulnerabilities and threats

The mktemp utility in uutils coreutils improperly handles an empty TMPDIR environment variable by treating it as a valid path rather than falling back to /tmp. This causes temporary files to be created in the current working directory instead of a secure temporary directory. If the current directory has more permissive access controls, this behavior may lead to unintended information disclosure or unauthorized access to temporary files. The vulnerability has a low severity with a CVSS score of 3.3. No patch or official remediation is currently documented.

CVE-2026-35341 is a vulnerability in the uutils coreutils mkfifo command where, if mkfifo fails to create a FIFO because a file already exists at the target path, it incorrectly changes the permissions of the existing file to a default mode. This can expose sensitive files, such as SSH private keys, to unauthorized users by altering their permissions. The vulnerability has a high severity with a CVSS score of 7.1.

A flaw in the ChownExecutor used by uutils coreutils chown and chgrp causes the utilities to return an incorrect exit code during recursive operations. The final exit code is determined only by the last file processed. If the last operation succeeds, the command returns 0 even if earlier ownership or group changes failed due to permission errors. This can lead to security misconfigurations where administrative scripts incorrectly assume that ownership has been successfully transferred across a directory tree.

The chmod utility in uutils coreutils has a vulnerability in its recursive mode (-R) where it incorrectly reports success by only considering the exit code of the last file processed. This can cause scripts relying on exit codes to mistakenly believe all files were processed successfully, even if earlier files encountered errors such as 'Operation not permitted'. This may lead to sensitive files retaining incorrect permissions.

CVE-2026-35338 is a path traversal vulnerability in the chmod utility of uutils coreutils. The flaw allows bypassing the --preserve-root safety check because it only validates if the target path is exactly '/' without canonicalizing the path. This enables attackers or users to use path variants or symbolic links to perform recursive destructive operations on the root filesystem, potentially causing system-wide permission loss and complete system failure.