CVE-2026-35342 uutils coreutils mktemp Insecure Temporary File Placement via Empty TMPDIR

What is CVE-2026-35342?

CVE-2026-35342 is a low-severity vulnerability in Uutils coreutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid path. This causes temporary files to be created in the current working directory (CWD) instead of the intended secure temporary directory. If the CWD is more permissive or accessible to other users than /tmp, it may lead to unintended information disclosure or unauthorized access to temporary data.

Weakness: CWE-377

Which versions are affected by CVE-2026-35342?

2 open source packages ship an affected version, including uu_mktemp. It affects 1 product.

Products include Uutils Coreutils.

How do I fix CVE-2026-35342?

Upgrade uu_mktemp to 0.6.0 or later.

Is CVE-2026-35342 being exploited?

There is no known exploitation of CVE-2026-35342 in the wild and no public exploit code.

Other vulnerabilities in Uutils coreutils

• CVE-2026-35338 uutils coreutils chmod Path Traversal Bypass of --preserve-root High 7.3
• CVE-2026-35368 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection High 7.2
• CVE-2026-35341 uutils coreutils mkfifo Unauthorized Permission Change on Existing Files High 7.1
• CVE-2026-35352 uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition High 7.0
• CVE-2026-35349 uutils coreutils Path-Based Safety Bypass with --preserve-root Medium 6.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-35342, GHSA-2w8r-9xj7-69j5, UBUNTU-CVE-2026-35342.