CVE-2026-35372 uutils coreutils ln Security Bypass via Improper Handling of the --no-dereference Flag
A logic error in uutils coreutils ln allows bypassing the no-dereference flag, enabling attackers to create files in sensitive directories via symlink manipulation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-35372?
CVE-2026-35372 is a medium-severity path traversal vulnerability in Uutils coreutils, published on 22 Apr 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A logic error in the ln utility of uutils coreutils allows the utility to dereference a symbolic link target even when the --no-dereference (or -n) flag is explicitly provided. The implementation previously only honored the "no-dereference" intent if the --force (overwrite) mode was also enabled. This flaw causes ln to follow a symbolic link that points to a directory and create new links inside that target directory instead of treating the symbolic link itself as the destination. In environments where a privileged user or system script uses ln -n to update a symlink, a local attacker could manipulate existing symbolic links to redirect file creation into sensitive directories, potentially leading to unauthorized file creation or system misconfiguration.
Weakness: CWE-61
Which versions are affected by CVE-2026-35372?
2 open source packages ship an affected version, including coreutils. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
coreutils crates.io | All versions | 0.8.0 |
coreutils crates.io | All versions | 0.8.0 |
Products include Uutils Coreutils.
How do I fix CVE-2026-35372?
Upgrade coreutils to 0.8.0 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-35372 being exploited?
There is no known exploitation of CVE-2026-35372 in the wild and no public exploit code.
Other vulnerabilities in Uutils coreutils
- CVE-2026-35338 uutils coreutils chmod Path Traversal Bypass of --preserve-root
- CVE-2026-35368 uutils coreutils chroot Local Privilege Escalation and chroot Escape in via Name Service Switch (NSS) Injection
- CVE-2026-35341 uutils coreutils mkfifo Unauthorized Permission Change on Existing Files
- CVE-2026-35352 uutils coreutils mkfifo Privilege Escalation via TOCTOU Race Condition
- CVE-2026-35349 uutils coreutils Path-Based Safety Bypass with --preserve-root
Sources
Also known as DEBIAN-CVE-2026-35372, GHSA-wq63-vh5h-pr5p, UBUNTU-CVE-2026-35372.