CVE-2026-35374
uutils coreutils split Arbitrary File Truncation via Time-of-Check to Time-of-Use (TOCTOU) Race Condition
- Published
- Updated
- Reserved
- Assigned by
- canonical
Description
A Time-of-Check to Time-of-Use (TOCTOU) vulnerability exists in the split utility of uutils coreutils. The program attempts to prevent data loss by checking for identity between input and output files using their file paths before initiating the split operation. However, the utility subsequently opens the output file with truncation after this path-based validation is complete. A local attacker with write access to the directory can exploit this race window by manipulating mutable path components (e.g., swapping a path with a symbolic link). This can cause split to truncate and write to an unintended target file, potentially including the input file itself or other sensitive files accessible to the process, leading to permanent data loss.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| canonicalCNA (assigner) | 3.1 | Medium6.3 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | Medium6.3 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.07% · top 100% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.
Weakness
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- crates.iocoreutilsGHSA-4wrp-79m8-9m9p (opens in a new tab)
References (1)
- https://github.com/uutils/coreutils/pull/11401 (opens in a new tab)issue-trackingpatch
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-4wrp-79m8-9m9p (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-35374)Record last updated .