CVE-2026-35342

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-35342
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35342.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-35342
Aliases
Downstream
Published
2026-04-22T16:07:41.640Z
Modified
2026-07-08T08:12:58.299719674Z
Severity
  • 3.3 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
uutils coreutils mktemp Insecure Temporary File Placement via Empty TMPDIR
Details

The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid path. This causes temporary files to be created in the current working directory (CWD) instead of the intended secure temporary directory. If the CWD is more permissive or accessible to other users than /tmp, it may lead to unintended information disclosure or unauthorized access to temporary data.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35342.json",
    "cna_assigner": "canonical",
    "cwe_ids": [
        "CWE-377"
    ]
}
References

Affected packages

Git / github.com/uutils/coreutils

Affected ranges

Type
GIT
Repo
https://github.com/uutils/coreutils
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2319a99057d11b0c9744c885df84806eea019166
Database specific 
{
    "cpe": "cpe:2.3:a:uutils:coreutils:*:*:*:*:*:rust:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.6.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

0.*
0.0.1
0.0.12
0.0.13
0.0.14
0.0.15
0.0.16
0.0.17
0.0.18
0.0.19
0.0.2
0.0.20
0.0.21
0.0.22
0.0.23
0.0.24
0.0.25
0.0.26
0.0.27
0.0.28
0.0.29
0.0.3
0.0.30
0.0.30-delete
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.1.0
0.2.0
0.2.2
0.3.0
0.4.0
0.5.0
Other
latest-commit

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35342.json"