Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-35350: uutils coreutils: Copying files can create privileged executables

CVE-2026-35350 · published 6 months ago

Summary

The cp utility in uutils coreutils may create files with unexpected privileges when copying with the -p flag. This can happen when the ownership of the copied file cannot be preserved. To avoid this, update to the latest version of uutils coreutils or use the GNU version of cp.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	rust-coreutils	All versions
Debian:13	debian	rust-coreutils	All versions
Debian:14	debian	rust-coreutils	All versions
rust	rivy	coreutils	<= 0.8.0
Ubuntu:24.04:LTS	canonical	rust-coreutils	All versions
–	uutils	coreutils	All versions `cpe:2.3:a:uutils:coreutils:-:::::rust::`

Original advisory text

uutils coreutils doesn't properly handle setuid and setgid bits when ownership preservation fails

The cp utility in uutils coreutils fails to properly handle setuid and setgid bits when ownership preservation fails. When copying with the -p (preserve) flag, the utility applies the source mode bits even if the chown operation is unsuccessful. This can result in a user-owned copy retaining original privileged bits, creating unexpected privileged executables that violate local security policies. This differs from GNU cp, which clears these bits when ownership cannot be preserved.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-35350
https://github.com/advisories/GHSA-x2wv-9p67-mh9w
https://security-tracker.debian.org/tracker/CVE-2026-35350 Vendor Advisory
https://ubuntu.com/security/CVE-2026-35350 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-35350 Third Party Advisory
https://github.com/uutils/coreutils/issues/9750 Exploit Issue Tracking Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

6.6 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-281Improper Preservation of Permissions

Timeline

Published22 Apr 2026

Updated26 Oct 2026

First seen22 Apr 2026

Sources

DEBIAN-CVE-2026-35350 · OSV

CVE-2026-35350 · NVD

GHSA-x2wv-9p67-mh9w · GHSA

UBUNTU-CVE-2026-35350 · OSV

Track software like this

Free during beta