CVE-2026-35349 uutils coreutils Path-Based Safety Bypass with --preserve-root

What is CVE-2026-35349?

CVE-2026-35349 is a medium-severity path traversal vulnerability in Uutils coreutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in the rm utility of uutils coreutils allows a bypass of the --preserve-root protection. The implementation uses a path-string check rather than comparing device and inode numbers to identify the root directory. An attacker or accidental user can bypass this safeguard by using a symbolic link that resolves to the root directory (e.g., /tmp/rootlink -> /), potentially leading to the unintended recursive deletion of the entire root filesystem.

Weakness: CWE-59

Which versions are affected by CVE-2026-35349?

2 open source packages ship an affected version, including uu_rm. It affects 1 product.

Products include Uutils Coreutils.

How do I fix CVE-2026-35349?

Upgrade uu_rm to 0.7.0 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-35349 being exploited?

There is no known exploitation of CVE-2026-35349 in the wild and no public exploit code.

Other vulnerabilities in Uutils coreutils

• CVE-2026-35338 uutils coreutils chmod Path Traversal Bypass of --preserve-root High 7.3
• CVE-2026-35368 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection High 7.2
• CVE-2026-35341 uutils coreutils mkfifo Unauthorized Permission Change on Existing Files High 7.1
• CVE-2026-35352 uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition High 7.0
• CVE-2026-35350 uutils coreutils cp Unexpected Privileged Executable Creation with -p Medium 6.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-35349, GHSA-7cr3-h577-g38j, UBUNTU-CVE-2026-35349.