EUVD-2026-24994
GHSA-gwm6-q8ch-hcfr
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the install utility of uutils coreutils when using the -D flag. The command creates parent directories and subsequently performs a second path resolution to create the target file, neither of which is anchored to a directory file descriptor. An attacker with concurrent write access can replace a path component with a symbolic link between these operations, redirecting the privileged write to an arbitrary file system location.
AnalysisAI
Privilege escalation via symlink attack in uutils coreutils install utility when using the -D flag allows local attackers with write access to redirect privileged file writes to arbitrary locations. The vulnerability exploits a Time-of-Check to Time-of-Use (TOCTOU) race condition between parent directory creation and target file creation, neither anchored to a directory file descriptor. CISA reports no active exploitation (SSVC: none), but the attack is non-automatable and requires specific concurrent write access conditions.
Technical ContextAI
The install utility in uutils coreutils (a Rust implementation of GNU coreutils) uses the -D flag to create parent directories before writing target files. The vulnerability stems from CWE-367 (TOCTOU race condition): the tool resolves paths in two separate operations without using directory file descriptors to anchor the operations. An attacker with concurrent filesystem write access can replace intermediate path components (e.g., 'foo' in 'foo/bar/baz') with symbolic links between the directory creation phase and the file creation phase, causing the privileged process to follow the symlink and write to an attacker-controlled location. This is a classic privileged symlink attack pattern, mitigated in modern systems through openat()-style APIs that anchor operations to a known directory descriptor.
RemediationAI
Vendor-released patch: upgrade to uutils coreutils 0.7.0 or later, which anchors path operations to directory file descriptors to eliminate the TOCTOU window. For systems unable to upgrade immediately, restrict the install utility to operate only in directories where untrusted local users cannot create symbolic links or concurrent modifications. Alternative workaround: disable the -D flag if not required, or ensure the install utility runs with minimal privilege separation (do not run as root if possible). The patch carries no known side effects. Patch validation and deployment details available at https://github.com/uutils/coreutils/pull/10140.
The parse_datetime function in GNU coreutils allows remote attackers to cause a denial of service (crash) or possibly ex
Privilege escalation to root in uutils coreutils chroot utility allows low-privileged local attackers with write access
Recursive chmod operations can bypass --preserve-root protection in uutils coreutils versions prior to 0.6.0, allowing l
Local privilege escalation in uutils coreutils mkfifo allows authenticated users to downgrade permissions on arbitrary f
Privilege escalation in uutils coreutils mkfifo utility allows local attackers with low privileges to manipulate file pe
Bypass of --preserve-root protection in uutils coreutils rm utility allows local users to recursively delete the root fi
The mv utility in uutils coreutils improperly expands symbolic links instead of preserving them during moves across file
The cp utility in uutils coreutils improperly preserves setuid and setgid bits when the chown operation fails during fil
The split utility in uutils coreutils contains a time-of-check to time-of-use (TOCTOU) race condition that allows local
A time-of-check to time-of-use (TOCTOU) race condition in the mv utility of uutils coreutils during cross-device move op
The touch utility in uutils coreutils suffers from a Time-of-Check to Time-of-Use (TOCTOU) race condition that allows lo
Time-of-Check to Time-of-Use (TOCTOU) race condition in uutils coreutils install utility allows local authenticated atta
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today