---
id: CVE-2026-93658
title: >-
  uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install
  destinations before finalizing ownership changes, allowing privileged users to
  leave setuid executables owned by the privileged invoker when ownership
  changes…
summary: >-
  uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install
  destinations before finalizing ownership changes, allowing privileged users to
  leave setuid executables owned by the privileged invoker when ownership
  changes…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-281
vendor: uutils
product: coreutils
affected:
  - coreutils >= 0.0.18 < 0.10.0
published: '2026-09-18'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:25:55.870'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93658'
references:
  - url: 'https://github.com/uutils/coreutils'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/uutils/coreutils/blob/0.9.0/src/uu/install/src/install.rs
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/uutils/coreutils/commit/7c87ab04fee8e52d989fb2625568a3eeda1b1f55
    label: disclosure@vulncheck.com
  - url: 'https://github.com/uutils/coreutils/pull/13629'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/uutils-coreutils-0.0.18-before-0.10.0-privilege-escalation-via-setuid
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/uutils/coreutils/security/advisories/GHSA-cgg3-923w-v53m
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00139
epssPercentile: 0.02684
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-18T16:45:19.868483Z'
ingestedAt: '2026-09-18T14:43:13.069Z'
---

## Overview

uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing privileged users to leave setuid executables owned by the privileged invoker when ownership changes fail. Attackers can execute leftover setuid files with elevated privileges when ownership change operations fail on capability-restricted systems.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.