---
id: CVE-2026-35365
aliases:
  - GHSA-h444-6j9x-p8vh
title: >-
  mv: symlinks expanded during cross-device move (resource exhaustion / data
  duplication)
summary: >-
  mv: symlinks expanded during cross-device move (resource exhaustion / data
  duplication)
severity: medium
cvss: 6.6
cwe:
  - CWE-59
  - CWE-400
vendor: uu_mv
product: uu_mv
ecosystem: rust
affected:
  - uu_mv < 0.7.0
patched:
  - uu_mv 0.7.0
published: '2026-07-06'
updated: '2026-07-06'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-h444-6j9x-p8vh'
references:
  - url: >-
      https://github.com/uutils/coreutils/security/advisories/GHSA-h444-6j9x-p8vh
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-35365'
  - url: 'https://github.com/uutils/coreutils/pull/10546'
  - url: >-
      https://github.com/uutils/coreutils/commit/9654e4abaf24449ef2279e9a16963edb5c8b8fef
  - url: 'https://github.com/uutils/coreutils/releases/tag/0.7.0'
  - url: 'https://github.com/advisories/GHSA-h444-6j9x-p8vh'
tags:
  - ghsa
  - rust
epss: 0.00187
epssPercentile: 0.07369
ingestedAt: '2026-07-06T20:46:12.666Z'
---

## Overview

When moving directories across filesystems, uutils `mv` dereferences symlinks inside the tree, copying their targets as real files/dirs instead of preserving the symlinks. GNU preserves symlinks by default. E.g. a `etc_link -> /etc` inside the source becomes a full copy of `/etc` at the destination.

**Impact:** (1) resource exhaustion — a small tree can expand into a huge copy (time/disk DoS); (2) unintended duplication of sensitive paths referenced by symlink; (3) symlink-loop amplification causing deep recursion. Recommendation: in cross-device fallback, detect symlinks via `symlink_metadata()` and recreate with `read_link()`/`symlink()`; add loop detection.

**Remediation:** Acknowledged by Canonical; fixed in commit 9654e4ab.

---
_Reported by Zellic in the *uutils coreutils Program Security Assessment* (prepared for Canonical, Jan 20 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`. Finding 3.63. Credit: Zellic._

## Affected packages

- `uu_mv < 0.7.0`

## Remediation

Upgrade to a patched release:

- `uu_mv 0.7.0`