CVE-2026-35362Low· 3.6▾ Sunlituucore: safe_traversal TOCTOU protection only enabled on Linux
▾ Sunlit zone — Low / medium · no exploitation signal
impact 19.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and FreeBSD, the utility fails to utilize these protections, leaving directory traversal operations vulnerable to symlink race conditions.
Zellic finding 3.59. Reported in the Zellic uutils coreutils Program Security Assessment (for Canonical, Jan 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242.
uucore < 0.6.0Upgrade to a patched release:
uucore 0.6.0Connected by shared product, vendor, weakness, or advisory.
GHSA-fqf6-gxhh-2xhwHighuutils coreutils: cp/install/mv/ln --suffix alone does not enable backup mode (silent data loss vs GNU)
CVE-2026-23950High· 8.8node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3
CVE-2026-35355Medium· 6.3install: TOCTOU symlink race (unlink-then-create without O_EXCL) allows arbitrary file overwrite
CVE-2026-35353Low· 3.3mkdir: -m exposes directory with umask perms before chmod (race window)
CVE-2026-29518High· 7.0Rsync versions before 3.4.3 contain a time-of-check to time-of-use (TOCTOU) race condition in daemon file handling that allows attackers to redirect file writes outside intended directories by replacing parent directory components with s…
CVE-2022-21198High· 7.9Time-of-check time-of-use race condition in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.