Skip to content
OpenAdvisories
High · 7.3 CVE-2026-35338 EUVD-2026-24963GHSA-4c7q-4928-8445GHSA-9gqx-53gp-c8g3

uutils coreutils chmod Path Traversal Bypass of --preserve-root

Published Apr 22, 2026 · Updated Apr 24, 2026 · Assigned by canonical

Description

A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism. The implementation only validates if the target path is literally / and does not canonicalize the path. An attacker or accidental user can use path variants such as /../ or symbolic links to execute destructive recursive operations (e.g., chmod -R 000) on the entire root filesystem, leading to system-wide permission loss and potential complete system breakdown.

Affected products

VendorProductAffectedFixed
Uutils coreutils < 0.6.0 0.6.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 rust-coreutils 0.6.0-1 —
Debian 13 rust-coreutils No fix yet —
Debian 12 rust-coreutils No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 25.10 rust-coreutils No fix yet —
Ubuntu 24.04 LTS rust-coreutils No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io uu_chmod < 0.6.0 0.6.0 GHSA-4c7q-4928-8445

References