Skip to content
OpenAdvisories
Medium · 6.6 CVE-2026-35365 EUVD-2026-25012GHSA-66fx-fqv6-5wwxGHSA-h444-6j9x-p8vh

uutils coreutils mv Denial of Service and Data Duplication via Improper Symlink Expansion

Published Apr 22, 2026 · Updated Apr 22, 2026 · Assigned by canonical

Description

The mv utility in uutils coreutils improperly handles directory trees containing symbolic links during moves across filesystem boundaries. Instead of preserving symlinks, the implementation expands them, copying the linked targets as real files or directories at the destination. This can lead to resource exhaustion (disk space or time) if symlinks point to large external directories, unexpected duplication of sensitive data into unintended locations, or infinite recursion and repeated copying in the presence of symlink loops.

Affected products

VendorProductAffectedFixed
Uutils coreutils < 0.7.0 0.7.0

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 rust-coreutils 0.8.0-1 —
Debian 13 rust-coreutils No fix yet —
Debian 12 rust-coreutils No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 25.10 rust-coreutils No fix yet —
Ubuntu 24.04 LTS rust-coreutils No fix yet —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io uu_mv < 0.7.0 0.7.0 GHSA-h444-6j9x-p8vh

References