{"id":"CVE-2026-35373","aliases":["GHSA-jcjr-rh8q-7xqf"],"title":"ln: rejects non-UTF-8 source filenames in target-directory mode","summary":"ln: rejects non-UTF-8 source filenames in target-directory mode","severity":"low","cvss":3.3,"cwe":["CWE-176"],"vendor":"uu_ln","product":"uu_ln","ecosystem":"rust","affected":["uu_ln < 0.6.0"],"patched":["uu_ln 0.6.0"],"published":"2026-07-06","updated":"2026-07-06","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-jcjr-rh8q-7xqf","references":[{"url":"https://github.com/uutils/coreutils/security/advisories/GHSA-jcjr-rh8q-7xqf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35373"},{"url":"https://github.com/uutils/coreutils/pull/11403"},{"url":"https://github.com/advisories/GHSA-jcjr-rh8q-7xqf"}],"tags":["ghsa","rust"],"epss":0.00121,"epssPercentile":0.02218,"ingestedAt":"2026-07-06T20:46:12.691Z","slug":"CVE-2026-35373","body":"## Overview\n\nIn target-directory forms (`ln SOURCE... DIRECTORY`), `ln` rejects source paths with non-UTF-8 filename bytes, while GNU accepts them. Breaks GNU compatibility for byte-oriented filenames on Unix filesystems.\n\nPoC:\n```\nname=$(printf 'bad_\\377'); mkdir dst; : > \"$name\"; ln \"$name\" dst\n# GNU: exit 0, creates dst/bad_\\377 ; uutils: exit 1, dst empty\n```\n\n---\n_Zellic private finding (zellic-ext/coreutils-private PR #84). Reported in the Zellic *uutils coreutils Program Security Assessment* (for Canonical, Jan 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`._\n\n## Affected packages\n\n- `uu_ln < 0.6.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `uu_ln 0.6.0`","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}