CVE Feed

    Dashboard / CVE / CVE-2026-35340

    CVE-2026-35340

    A flaw in the ChownExecutor used by uutils coreutils chown and chgrp causes the utilities to return an incorrect exit code during recursive operations. The final exit code is determined only by the last file processed. If the last operation succeeds, the command returns 0 even if earlier ownership or group changes failed due to permission errors. This can lead to security misconfigurations where administrative scripts incorrectly assume that ownership has been successfully transferred across a directory tree.

    Published:Apr 22, 2026
    Last Modified:May 4, 2026
    EPS:Apr 22, 2026
    EPSS Score:0.00014
    CVSS Score:5.5

    Affected Products

    Vendor
    Uutils
    Product
    Coreutils

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-35381 (CVSS 3.3) — A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag…
    CVE-2026-35380 (CVSS 5.5) — A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal t…
    CVE-2026-35379 (CVSS 3.3) — A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and…
    CVE-2026-35378 (CVSS 3.3) — A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressi…
    CVE-2026-35377 (CVSS 3.3) — A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line argument…
    CVE-2026-35376 (CVSS 4.5) — A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the chcon utility of uutils coreutils during r…
    CVE-2026-35375 (CVSS 3.3) — A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided…
    CVE-2026-35374 (CVSS 6.3) — A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The pro…
    CVE-2026-35373 (CVSS 3.3) — A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-U…
    CVE-2026-35372 (CVSS 5) — A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target e…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High