CVE Feed

    Dashboard / CVE / CVE-2026-35349

    CVE-2026-35349

    A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. The implementation uses a path-string check rather than comparing device and inode numbers to identify the root directory. An attacker or accidental user can bypass this safeguard by using a symbolic link that resolves to the root directory (e.g., /tmp/rootlink -> /), potentially leading to the unintended recursive deletion of the entire root filesystem.

    Published:Apr 22, 2026
    Last Modified:Apr 27, 2026
    EPS:Apr 22, 2026
    EPSS Score:0.00011
    CVSS Score:6.7

    Affected Products

    Vendor
    Uutils
    Product
    Coreutils

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-35381 (CVSS 3.3) — A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag…
    CVE-2026-35380 (CVSS 5.5) — A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal t…
    CVE-2026-35379 (CVSS 3.3) — A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and…
    CVE-2026-35378 (CVSS 3.3) — A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressi…
    CVE-2026-35377 (CVSS 3.3) — A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line argument…
    CVE-2026-35376 (CVSS 4.5) — A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the chcon utility of uutils coreutils during r…
    CVE-2026-35375 (CVSS 3.3) — A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided…
    CVE-2026-35374 (CVSS 6.3) — A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The pro…
    CVE-2026-35373 (CVSS 3.3) — A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-U…
    CVE-2026-35372 (CVSS 5) — A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target e…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High