CVE-2026-35356Medium· 6.3▾ Sunlitinstall -D: symlink race in directory creation allows arbitrary file overwrite
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.1%
0.1% → 0.1%
The -D path runs fs::create_dir_all on a pathname then later opens the destination via path-based File::create/fs::copy, neither anchored to a directory fd. Between the two, an attacker can replace a path component with a symlink, redirecting the write.
Impact: an attacker with concurrent write access to the destination tree can redirect a privileged install -D to an arbitrary location, enabling arbitrary file overwrite with attacker-controlled content. Recommendation: use dirfd-based traversal (openat/mkdirat + O_NOFOLLOW) per component and create the destination via openat on the same dirfd.
Remediation: Acknowledged by Canonical; fixed in commit 0c412999.
Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.51. Credit: Zellic.
uu_install < 0.7.0Upgrade to a patched release:
uu_install 0.7.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-35355Medium· 6.3install: TOCTOU symlink race (unlink-then-create without O_EXCL) allows arbitrary file overwrite
CVE-2026-23950High· 8.8node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3
CVE-2026-54587Medium· 5.8mport is the MidnightBSD Package Manager
CVE-2026-54576Medium· 5.8mport is the MidnightBSD Package Manager
CVE-2026-86861Medium· 5.9pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.check_access_permission() and then opened the file for writing with a plain open() call
CVE-2026-53796Medium· 6.3rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the non-daemon receiver's destination directory handling that allows an attacker who can manipulate destination path parent components to…