CVE Feed

    Dashboard / CVE / CVE-2026-35351

    CVE-2026-35351

    The mv utility in uutils coreutils fails to preserve file ownership during moves across different filesystem boundaries. The utility falls back to a copy-and-delete routine that creates the destination file using the caller's UID/GID rather than the source's metadata. This flaw breaks backups and migrations, causing files moved by a privileged user (e.g., root) to become root-owned unexpectedly, which can lead to information disclosure or restricted access for the intended owners.

    Published:Apr 22, 2026
    Last Modified:Apr 27, 2026
    EPS:Apr 22, 2026
    EPSS Score:0.00009
    CVSS Score:4.2

    Affected Products

    Vendor
    Uutils
    Product
    Coreutils

    Exploits

    https://github.com/uutils/coreutils/issues/9714https://github.com/uutils/coreutils/issues/9714

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-35381 (CVSS 3.3) — A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag…
    CVE-2026-35380 (CVSS 5.5) — A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal t…
    CVE-2026-35379 (CVSS 3.3) — A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and…
    CVE-2026-35378 (CVSS 3.3) — A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressi…
    CVE-2026-35377 (CVSS 3.3) — A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line argument…
    CVE-2026-35376 (CVSS 4.5) — A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the chcon utility of uutils coreutils during r…
    CVE-2026-35375 (CVSS 3.3) — A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided…
    CVE-2026-35374 (CVSS 6.3) — A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The pro…
    CVE-2026-35373 (CVSS 3.3) — A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-U…
    CVE-2026-35372 (CVSS 5) — A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target e…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High