CVE-2026-35365

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-35365
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35365.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-35365
Aliases
Downstream
Published
2026-04-22T16:08:41.136Z
Modified
2026-07-08T08:12:59.371471047Z
Severity
  • 6.6 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L CVSS Calculator
Summary
uutils coreutils mv Denial of Service and Data Duplication via Improper Symlink Expansion
Details

The mv utility in uutils coreutils improperly handles directory trees containing symbolic links during moves across filesystem boundaries. Instead of preserving symlinks, the implementation expands them, copying the linked targets as real files or directories at the destination. This can lead to resource exhaustion (disk space or time) if symlinks point to large external directories, unexpected duplication of sensitive data into unintended locations, or infinite recursion and repeated copying in the presence of symlink loops.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35365.json",
    "cna_assigner": "canonical",
    "cwe_ids": [
        "CWE-59"
    ]
}
References

Affected packages

Git / github.com/uutils/coreutils

Affected ranges

Type
GIT
Repo
https://github.com/uutils/coreutils
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
995c9e04a6cc34a3a95b23a26fa59ae87e7744bd
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:uutils:coreutils:*:*:*:*:*:rust:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.7.0"
        }
    ]
}

Affected versions

0.*
0.0.1
0.0.12
0.0.13
0.0.14
0.0.15
0.0.16
0.0.17
0.0.18
0.0.19
0.0.2
0.0.20
0.0.21
0.0.22
0.0.23
0.0.24
0.0.25
0.0.26
0.0.27
0.0.28
0.0.29
0.0.3
0.0.30
0.0.30-delete
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.1.0
0.2.0
0.2.2
0.3.0
0.4.0
0.5.0
0.6.0
Other
latest-commit

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-35365.json"