uutils coreutils chmod Path Traversal Bypass of --preserve-root

Description

A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root safety mechanism. The implementation only validates if the target path is literally / and does not canonicalize the path. An attacker or accidental user can use path variants such as /../ or symbolic links to execute destructive recursive operations (e.g., chmod -R 000) on the entire root filesystem, leading to system-wide permission loss and potential complete system breakdown.

Scores

EPSS (exploitation in 30 days)

0.18% · top 93% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.3.

Weakness

• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (opens in a new tab)All about CWE-22 and its CVEs

Affected products

• Uutils · coreutils

  • affected < 0.6.0

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• crates.iouu_chmodGHSA-4c7q-4928-8445 (opens in a new tab)

References (2)

• https://github.com/uutils/coreutils/pull/10033 (opens in a new tab)patchissue-tracking
• https://github.com/uutils/coreutils/releases/tag/0.6.0 (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-4c7q-4928-8445 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-35338](https://trackcve.app/badge/CVE-2026-35338.svg)](https://trackcve.app/cve/CVE-2026-35338)

Record last updated 24 Apr 2026, 03:55 UTC.