CVE Feed

    Dashboard / CVE / CVE-2026-93658

    CVE-2026-93658

    uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.

    Published:Sep 18, 2026
    Last Modified:Sep 22, 2026
    EPS:Sep 18, 2026
    EPSS Score:0.00152
    CVSS Score:7

    Affected Products

    Vendor
    Uutils
    Product
    Coreutils

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-81 Web Server Logs Tampering

    Related CVEs

    CVE-2026-35381 (CVSS 3.3) — A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag…
    CVE-2026-35380 (CVSS 5.5) — A logic error in the cut utility of uutils coreutils causes the program to incorrectly interpret the literal t…
    CVE-2026-35379 (CVSS 3.3) — A logic error in the tr utility of uutils coreutils causes the program to incorrectly define the [:graph:] and…
    CVE-2026-35378 (CVSS 3.3) — A logic error in the expr utility of uutils coreutils causes the program to evaluate parenthesized subexpressi…
    CVE-2026-35377 (CVSS 3.3) — A logic error in the env utility of uutils coreutils causes a failure to correctly parse command-line argument…
    CVE-2026-35376 (CVSS 4.5) — A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the chcon utility of uutils coreutils during r…
    CVE-2026-35375 (CVSS 3.3) — A logic error in the split utility of uutils coreutils causes the corruption of output filenames when provided…
    CVE-2026-35374 (CVSS 6.3) — A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The pro…
    CVE-2026-35373 (CVSS 3.3) — A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-U…
    CVE-2026-35372 (CVSS 5) — A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target e…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High