CVE-2026-35363 uutils coreutils rm Safeguard Bypass via Improper Path Normalization
Attackers can bypass rm safeguards to recursively delete current directory contents via path normalization flaws, causing data loss and DoS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-35363?
CVE-2026-35363 is a medium-severity path traversal vulnerability in Uutils coreutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A vulnerability in the rm utility of uutils coreutils allows the bypass of safeguard mechanisms intended to protect the current directory. While the utility correctly refuses to delete . or .., it fails to recognize equivalent paths with trailing slashes, such as ./ or .///. An accidental or malicious execution of rm -rf ./ results in the silent recursive deletion of all contents within the current directory. The command further obscures the data loss by reporting a misleading 'Invalid input' error, which may cause users to miss the critical window for data recovery.
Weakness: CWE-22
Which versions are affected by CVE-2026-35363?
2 open source packages ship an affected version, including uu_rm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
uu_rm crates.io | All versions | 0.6.0 |
uu_rm crates.io | All versions | 0.6.0 |
Products include Uutils Coreutils.
How do I fix CVE-2026-35363?
Upgrade uu_rm to 0.6.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-35363 being exploited?
There is no known exploitation of CVE-2026-35363 in the wild and no public exploit code.
Other vulnerabilities in Uutils coreutils
- CVE-2026-35338 uutils coreutils chmod Path Traversal Bypass of --preserve-root
- CVE-2026-35368 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection
- CVE-2026-35341 uutils coreutils mkfifo Unauthorized Permission Change on Existing Files
- CVE-2026-35352 uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition
- CVE-2026-35349 uutils coreutils Path-Based Safety Bypass with --preserve-root
Sources
Also known as DEBIAN-CVE-2026-35363, GHSA-89p7-7cq3-hhr2, UBUNTU-CVE-2026-35363.