CVE-2026-35338 uutils coreutils chmod Path Traversal Bypass of --preserve-root
Attackers can bypass root protection in chmod via path traversal, causing system-wide permission loss and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-35338?
CVE-2026-35338 is a high-severity path traversal vulnerability in Uutils coreutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism. The implementation only validates if the target path is literally / and does not canonicalize the path. An attacker or accidental user can use path variants such as /../ or symbolic links to execute destructive recursive operations (e.g., chmod -R 000) on the entire root filesystem, leading to system-wide permission loss and potential complete system breakdown.
Weakness: CWE-22
Which versions are affected by CVE-2026-35338?
2 open source packages ship an affected version, including uu_chmod. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
uu_chmod crates.io | All versions | 0.6.0 |
uu_chmod crates.io | All versions | 0.6.0 |
Products include Uutils Coreutils.
How do I fix CVE-2026-35338?
Upgrade uu_chmod to 0.6.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-35338 being exploited?
There is no known exploitation of CVE-2026-35338 in the wild and no public exploit code.
Other vulnerabilities in Uutils coreutils
- CVE-2026-35368 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection
- CVE-2026-35341 uutils coreutils mkfifo Unauthorized Permission Change on Existing Files
- CVE-2026-35352 uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition
- CVE-2026-35349 uutils coreutils Path-Based Safety Bypass with --preserve-root
- CVE-2026-35350 uutils coreutils cp Unexpected Privileged Executable Creation with -p
Sources
Also known as DEBIAN-CVE-2026-35338, GHSA-4c7q-4928-8445, UBUNTU-CVE-2026-35338.