{"vulnerability": "CVE-2026-35338", "sightings": [{"uuid": "e755e407-6ee2-4349-a9ae-a74ebc60c7d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-35338", "type": "seen", "source": "Telegram/y1XO5mBm2flLcrjS5YpFLtlumq47M984z8tJCHS_wnxFgvg", "content": "", "creation_timestamp": "2026-04-22T19:23:16.000000Z"}, {"uuid": "ddd1d916-c4d3-4942-a328-0380a6efcf5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-35338", "type": "seen", "source": "https://gist.github.com/alon710/1cf52ea2dbf4e032410868a401b20900", "content": "# CVE-2026-35338: CVE-2026-35338: Path Validation Bypass in uutils/coreutils chmod --preserve-root Option\n\n> **CVSS Score:** 7.3\n> **Published:** 2026-07-06\n> **Full Report:** https://cvereports.com/reports/CVE-2026-35338\n\n## Summary\nA path validation bypass vulnerability exists in the chmod utility of uutils/coreutils before version 0.6.0. The '--preserve-root' safety mechanism relies on a literal string comparison, allowing local users to bypass root directory protection via unnormalized paths (such as '/../' or symbolic links) and recursively alter system-wide permissions.\n\n## TL;DR\nA vulnerability in uutils/coreutils chmod allows local bypass of '--preserve-root' safety checks using unnormalized paths like '/../', leading to recursive root permission destruction.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Local (AV:L)\n- **CVSS v3.1 Score**: 7.3\n- **EPSS Score**: 0.00175\n- **EPSS Percentile**: 7.13%\n- **Impact**: Local Denial of Service / Structural Permissions Failure\n- **Exploit Status**: Proof of Concept Available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- uutils/coreutils (chmod recursive execution)\n- **uutils/coreutils**: < 0.6.0 (Fixed in: `0.6.0`)\n\n## Mitigation\n\n- Upgrade uutils/coreutils to version 0.6.0 or higher.\n- Deploy shell auditing/monitoring rules to detect recursive execution parameters referencing parent paths.\n- Implement MAC policies (AppArmor, SELinux) to restrict recursive chmod permissions on system critical directories.\n\n**Remediation Steps:**\n1. Identify environments utilizing uutils/coreutils (commonly used in Rust-based container base images or alternative coreutils installations).\n2. Check current installed version via `chmod --version` or system package manager.\n3. Update the package to at least 0.6.0. If installing via Cargo, execute `cargo install uutils-coreutils --locked`.\n4. Verify compliance by attempting a non-destructive verification: run `chmod -R --preserve-root 755 /../` using an unprivileged user to confirm that the safe block triggers immediately.\n\n## References\n\n- [CVE org Entry](https://www.cve.org/CVERecord?id=CVE-2026-35338)\n- [uutils/coreutils Release Tag 0.6.0](https://github.com/uutils/coreutils/releases/tag/0.6.0)\n- [Security Fix Pull Request #10033](https://github.com/uutils/coreutils/pull/10033)\n- [Official Fix Commit](https://github.com/uutils/coreutils/commit/413055b378fa6fe2299c5e5f538c8e6e841ab810)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-35338) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-06T18:12:26.916500Z"}, {"uuid": "fd303294-4957-4055-a775-f311c65a7ccd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-35338", "type": "published-proof-of-concept", "source": "https://github.com/uutils/coreutils/security/advisories/GHSA-4c7q-4928-8445", "content": "", "creation_timestamp": "2026-07-06T18:35:04.498391Z"}]}