uutils coreutils CVE-2026-35338

Local authenticated access (PR:L) to a system running uutils coreutils version prior to 0.6.0 where the chmod utility is invoked with --preserve-root flag and user interaction provides a path variant (UI:R). Specifically requires: user must intentionally execute chmod with recursive flags (-R or --recursive) targeting root filesystem using path traversal sequences (/../, /./, etc.) or symbolic links that resolve to root, AND user must include --preserve-root flag believing it provides protection. Exploitation is self-inflicted through operator error rather than remote attack. Systems using default GNU coreutils installations are NOT vulnerable. The vulnerability is platform-agnostic across any operating system where uutils coreutils is deployed. User must have sufficient privileges to execute chmod on system directories (typically requires sudo or root context despite PR:L indicating low privilege).

Real-world risk is moderate despite the HIGH CVSS 7.3 score. CVSS vector (AV:L/AC:L/PR:L/UI:R) requires local authenticated access and user interaction, limiting attack surface to systems where uutils coreutils is installed and users intentionally invoke chmod with --preserve-root. EPSS score of 0.01% (1st percentile) indicates extremely low probability of widespread exploitation. SSVC framework confirms no active exploitation, non-automatable nature, but acknowledges total technical impact (complete permission loss). The vulnerability is primarily a safety mechanism bypass rather than a traditional security boundary violation - exploitation requires users to deliberately run destructive commands they believe are protected. Systems using GNU coreutils (default on most Linux distributions) are unaffected; uutils coreutils is typically found in Rust-based environments, embedded systems, or alternative distributions. Patch availability in version 0.6.0 since release significantly reduces residual risk. This is a high-consequence but low-probability issue requiring immediate remediation for affected systems, but NOT a widespread enterprise threat.

A system administrator on a server running uutils coreutils intends to modify permissions on a subdirectory but accidentally targets the root filesystem, relying on --preserve-root for protection. The administrator executes 'chmod -R 000 /../ --preserve-root' or creates a symbolic link pointing to root and uses it as the target path. The flawed validation logic fails to recognize these paths resolve to root, allowing the recursive operation to proceed. Within minutes, all filesystem permissions are set to 000, rendering the system completely inaccessible as no process can read executables, libraries, or configuration files, requiring emergency recovery procedures or complete reinstallation.