uutils coreutils CVE-2026-35372

Exploitation requires that: (1) the vulnerable version of uutils coreutils (< 0.8.0) is installed and actively used; (2) a user or system process invokes the ln command with the -n (--no-dereference) flag WITHOUT the -f (--force) flag; (3) the attacker can create or modify symbolic links in directories that are referenced as arguments to ln; (4) those symlinks must point to directories where the attacker can influence file creation outcomes; (5) the user running ln must have sufficient privileges to create files in the target directory. Additionally, the ln command must not have been patched or replaced with a wrapper. The UI:R component of the CVSS vector indicates user interaction is required - this is not an unauthenticated remote exploit. Configurations that limit local user access to the ln utility, run ln exclusively with the -f flag, or use alternative tools (like install -d) instead of ln reduce or eliminate risk.

The CVSS vector (AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) correctly identifies this as a local privilege escalation vector requiring low complexity and user interaction (UI:R), with no confidentiality impact but high integrity impact. The SSVC framework (Exploitation: none, Automatable: no, Technical Impact: partial) suggests this is not currently actively exploited and cannot be fully automated, reducing real-world risk. However, the condition UI:R is critical: this requires a user to invoke the vulnerable command, typically a system administrator or privileged script. The realistic threat model is a local attacker who can pre-position malicious symlinks in locations where privileged processes run ln -n commands (e.g., package managers, system configuration scripts). The fact that this requires symlink manipulation and user interaction limits widespread automated exploitation, but in multi-user systems or containers with shared directories, the risk is moderate. The integrity impact is high because file creation in sensitive directories could compromise system configuration or escalate privileges if those directories are later read by higher-privilege processes.

A system administrator runs a cron job that periodically executes ln -n /etc/config/app.conf /etc/app/symlink to update a symbolic link in a shared application directory. A local attacker (low-privilege user) pre-positions a malicious symbolic link at /etc/config/app.conf pointing to /etc/passwd or another sensitive directory. When the cron job runs, the vulnerable ln utility dereferences this symlink and creates new files inside /etc/passwd (if a directory exists) or /etc/, corrupting system configuration. Exploitation requires the attacker to have write access to directories where ln targets originate and knowledge of which ln -n commands are executed by privileged users.