CVE-2026-35338High· 7.3▾ Twilightchmod: --preserve-root bypassed by any path that resolves to root (e.g. /../)
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
Chmoder::chmod() only compares the literal argument against Path::new("/"), so the --preserve-root guard is bypassed by any path that resolves to root — a symlink to / or simply /../.
if self.recursive && self.preserve_root && file == Path::new("/") {
return Err(ChmodError::PreserveRoot("/".to_string()).into());
}
PoC — recursively chmods the entire filesystem to 000 despite --preserve-root:
chmod -R --preserve-root 000 /../ -v
Impact: --preserve-root is the documented safeguard against destructive recursive operations on /. Bypassing it allows chmod -R to alter permissions across the whole filesystem, causing a complete system breakdown. Recommendation: canonicalize the target path before comparing against root.
Remediation: Acknowledged by Canonical; fixed in commit 413055b3.
Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.1. Credit: Zellic.
uu_chmod < 0.6.0Upgrade to a patched release:
uu_chmod 0.6.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-35339Medium· 5.5chmod: recursive mode returns exit code 0 even when some files fail (last-file-wins)
CVE-2022-30333High· 7.5RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file
CVE-2026-15815High· 8.8Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives
CVE-2026-19693High· 8.1extract-zip: extract-zip: Arbitrary file write via symlink in archive (CVE-2026-19693)
CVE-2023-7260High· 7.5Path Traversal vulnerability discovered in OpenText™ CX-E Voice, affecting all version through 22.4
CVE-2023-7249Critical· 9.8Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in OpenText OpenText Directory Services allows Path Traversal.This issue affects OpenText Directory Services: from 16.4.2 before 24.1.