---
id: CVE-2026-35355
aliases:
  - GHSA-239g-2685-54x3
title: >-
  install: TOCTOU symlink race (unlink-then-create without O_EXCL) allows
  arbitrary file overwrite
summary: >-
  install: TOCTOU symlink race (unlink-then-create without O_EXCL) allows
  arbitrary file overwrite
severity: medium
cvss: 6.3
cwe:
  - CWE-59
  - CWE-367
vendor: uu_install
product: uu_install
ecosystem: rust
affected:
  - uu_install < 0.6.0
patched:
  - uu_install 0.6.0
published: '2026-07-06'
updated: '2026-07-06'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-239g-2685-54x3'
references:
  - url: >-
      https://github.com/uutils/coreutils/security/advisories/GHSA-239g-2685-54x3
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-35355'
  - url: 'https://github.com/uutils/coreutils/pull/10067'
  - url: >-
      https://github.com/uutils/coreutils/commit/b5bbabc18a1121908848d836f869a4e98eb63886
  - url: 'https://github.com/uutils/coreutils/releases/tag/0.6.0'
  - url: 'https://github.com/advisories/GHSA-239g-2685-54x3'
tags:
  - ghsa
  - rust
epss: 0.00118
epssPercentile: 0.01939
ingestedAt: '2026-07-06T20:46:12.689Z'
---

## Overview

`copy_file` in `install/src/install.rs` removes the destination then recreates it by pathname via `File::create` / `fs::copy` without `O_EXCL`/`create_new`. Between the unlink and the recreate, a local attacker with write access to the destination directory can drop in a symlink and redirect the write.

**Impact:** when `install` runs privileged into an attacker-writable directory (staging/build paths), the race allows redirecting writes to arbitrary files and overwriting sensitive system files (`/etc/passwd`, `/etc/shadow`). Recommendation: create atomically with `create_new`/`O_EXCL` and copy via the opened fd rather than reopening by path.

**Remediation:** Acknowledged by Canonical; fixed in commit b5bbabc1.

---
_Reported by Zellic in the *uutils coreutils Program Security Assessment* (prepared for Canonical, Jan 20 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`. Finding 3.50. Credit: Zellic._

## Affected packages

- `uu_install < 0.6.0`

## Remediation

Upgrade to a patched release:

- `uu_install 0.6.0`