uucore

Version	Released
`0.11.0` minor	Sep 01, 2026
`0.10.0` minor	Aug 05, 2026
`0.9.0` unknown	May 30, 2026
`0.8.0` unknown	Apr 06, 2026
`0.7.0` unknown	Mar 09, 2026
`0.6.0` unknown	Feb 03, 2026
`0.5.0` unknown 2 CVEs	Dec 14, 2025
`0.4.0` unknown 2 CVEs	Nov 10, 2025
`0.3.0` unknown 2 CVEs	Oct 25, 2025
`0.2.2` unknown 2 CVEs	Sep 09, 2025
`0.2.1` unknown yanked 2 CVEs	Sep 09, 2025
`0.2.0` unknown 2 CVEs	Sep 06, 2025
`0.1.0` unknown 2 CVEs	May 24, 2025
`0.0.30` unknown 2 CVEs	Mar 08, 2025
`0.0.29` unknown 2 CVEs	Jan 18, 2025
`0.0.28` unknown 2 CVEs	Nov 17, 2024
`0.0.27` unknown 2 CVEs	Jun 22, 2024
`0.0.26` unknown 2 CVEs	Apr 26, 2024
`0.0.25` unknown 2 CVEs	Mar 23, 2024
`0.0.24` unknown 2 CVEs	Jan 24, 2024
`0.0.23` unknown 2 CVEs	Nov 14, 2023
`0.0.22` unknown 2 CVEs	Oct 15, 2023
`0.0.21` unknown 2 CVEs	Sep 04, 2023
`0.0.20` unknown 2 CVEs	Jul 14, 2023
`0.0.19` unknown 2 CVEs	Jun 04, 2023
`0.0.18` unknown 2 CVEs	Apr 02, 2023
`0.0.17` unknown 2 CVEs	Jan 21, 2023
`0.0.16` unknown 2 CVEs	Oct 12, 2022
`0.0.15` unknown 2 CVEs	Aug 20, 2022
`0.0.14` unknown 2 CVEs	May 22, 2022
`0.0.13` unknown 2 CVEs	Apr 02, 2022
`0.0.12` unknown 2 CVEs	Jan 19, 2022
`0.0.11` unknown 2 CVEs	Jan 16, 2022
`0.0.10` unknown 2 CVEs	Oct 23, 2021
`0.0.9` unknown 2 CVEs	Jul 11, 2021
`0.0.8` unknown 2 CVEs	Apr 03, 2021
`0.0.7` unknown 2 CVEs	Mar 07, 2021
`0.0.6` unknown 2 CVEs	Feb 01, 2021
`0.0.5` unknown 2 CVEs	Jan 10, 2021
`0.0.4` unknown 2 CVEs	May 27, 2020
`0.0.3` unknown 2 CVEs	May 24, 2020
`0.0.2` unknown 2 CVEs	Apr 22, 2020
`0.0.1` unknown 2 CVEs	May 13, 2019

0.11.0 minor

Sep 01, 2026

0.10.0 minor

Aug 05, 2026

0.9.0 unknown

May 30, 2026

0.8.0 unknown

Apr 06, 2026

0.7.0 unknown

Mar 09, 2026

0.6.0 unknown

Feb 03, 2026

0.5.0 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Dec 14, 2025

0.4.0 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Nov 10, 2025

0.3.0 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Oct 25, 2025

0.2.2 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Sep 09, 2025

0.2.1 unknown yanked

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Sep 09, 2025

0.2.0 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Sep 06, 2025

0.1.0 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

May 24, 2025

0.0.30 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Mar 08, 2025

0.0.29 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 18, 2025

0.0.28 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Nov 17, 2024

0.0.27 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jun 22, 2024

0.0.26 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Apr 26, 2024

0.0.25 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Mar 23, 2024

0.0.24 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 24, 2024

0.0.23 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Nov 14, 2023

0.0.22 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Oct 15, 2023

0.0.21 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Sep 04, 2023

0.0.20 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jul 14, 2023

0.0.19 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jun 04, 2023

0.0.18 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Apr 02, 2023

0.0.17 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 21, 2023

0.0.16 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Oct 12, 2022

0.0.15 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Aug 20, 2022

0.0.14 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

May 22, 2022

0.0.13 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Apr 02, 2022

0.0.12 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 19, 2022

0.0.11 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 16, 2022

0.0.10 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Oct 23, 2021

0.0.9 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jul 11, 2021

0.0.8 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Apr 03, 2021

0.0.7 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Mar 07, 2021

0.0.6 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Feb 01, 2021

0.0.5 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Jan 10, 2021

0.0.4 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

May 27, 2020

0.0.3 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

May 24, 2020

0.0.2 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

Apr 22, 2020

0.0.1 unknown

2 CVEs

GHSA-fqf6-gxhh-2xhw Jul 07, 2026

uutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)

High

Local Low None None

determine_backup_mode in src/uucore/src/lib/features/backup_control.rs only checks --backup/-b and returns BackupMode::None when only --suffix is given. GNU enables backup mode when --suffix is used alone (defaulting to existing/numbered, or $VERSION_CONTROL). Affects cp, install, mv, ln which share this code.

# uutils: no backup created
$ coreutils cp --suffix=.bak src dest      # dest.bak NOT created
# GNU: dest.bak created
$ cp --suffix=.bak src dest

Impact: users/scripts relying on --suffix to back up a file before overwrite get silent data loss; breaks GNU compatibility across four utilities. Recommendation: enable backup mode when --suffix is present.

Note: this is primarily a GNU-compatibility/data-safety divergence rather than a classic exploitable vulnerability — review whether it warrants a CVE.

Remediation: Acknowledged by Canonical; fixed in PR #9741 (uucore: use --suffix to enable backup mode), commit 939ab037a, merged 2025-12-21. determine_backup_mode now has a --suffix-alone branch that resolves the mode from $VERSION_CONTROL (defaulting to existing). Released in uucore 0.6.0 and later (vulnerable: < 0.6.0). Regression tests added in the same file: test_backup_mode_suffix_without_backup_option and test_backup_mode_suffix_without_backup_option_with_env_var.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.7. Credit: Zellic.

Fixed in


          0.6.0

References

Updated Jul 07, 2026 · Source: OSV.dev

CVE-2026-35362 GHSA-w6xc-g9qj-vp32 Jul 06, 2026

uucore: safe_traversal TOCTOU protection only enabled on Linux

3.6 / 10

Low

Local High Low None Unchanged Low Low None

The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.

Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.

Fixed in


          0.6.0

References

Updated Jul 06, 2026 · Source: OSV.dev

May 13, 2019

Activity

Reach

Details