CVE-2026-35345 uutils coreutils tail Privileged Information Disclosure via Symlink Replacement Race
A local attacker can exploit a race condition in uutils tail to disclose sensitive file contents by replacing monitored files with symlinks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35345?
CVE-2026-35345 is a medium-severity vulnerability in Uutils coreutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability in the tail utility of uutils coreutils allows for the exfiltration of sensitive file contents when using the --follow=name option. Unlike GNU tail, the uutils implementation continues to monitor a path after it has been replaced by a symbolic link, subsequently outputting the contents of the link's target. In environments where a privileged user (e.g., root) monitors a log directory, a local attacker with write access to that directory can replace a log file with a symlink to a sensitive system file (such as /etc/shadow), causing tail to disclose the contents of the sensitive file.
Which versions are affected by CVE-2026-35345?
2 open source packages ship an affected version, including coreutils. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
coreutils crates.io | All versions to 0.8.0 | None |
coreutils crates.io | All versions to 0.8.0 | None |
Products include Uutils Coreutils.
How do I fix CVE-2026-35345?
Apply the vendor's patch.
Is CVE-2026-35345 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35345 exists.
Other vulnerabilities in Uutils coreutils
- CVE-2026-35338 uutils coreutils chmod Path Traversal Bypass of --preserve-root
- CVE-2026-35368 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection
- CVE-2026-35341 uutils coreutils mkfifo Unauthorized Permission Change on Existing Files
- CVE-2026-35352 uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition
- CVE-2026-35349 uutils coreutils Path-Based Safety Bypass with --preserve-root
Sources
Also known as DEBIAN-CVE-2026-35345, GHSA-xf75-659h-cgg5, UBUNTU-CVE-2026-35345.