EUVD-2026-24963
GHSA-9gqx-53gp-c8g3
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism. The implementation only validates if the target path is literally / and does not canonicalize the path. An attacker or accidental user can use path variants such as /../ or symbolic links to execute destructive recursive operations (e.g., chmod -R 000) on the entire root filesystem, leading to system-wide permission loss and potential complete system breakdown.
AnalysisAI
The chmod utility in uutils coreutils versions before 0.6.0 allows local authenticated users to bypass --preserve-root protections and recursively modify permissions on the entire root filesystem. The implementation fails to canonicalize paths before validation, accepting path traversal variants like /../ or symbolic links that resolve to root. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all systems running uutils coreutils and document current versions. Within 7 days: Update uutils coreutils to version 0.6.0 or later on all affected systems; test in non-production environment first. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today