GHSA-h444-6j9x-p8vh

Suggest an improvement
Source
https://github.com/advisories/GHSA-h444-6j9x-p8vh
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-h444-6j9x-p8vh/GHSA-h444-6j9x-p8vh.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-h444-6j9x-p8vh
Aliases
Published
2026-07-06T20:24:53Z
Modified
2026-07-06T20:31:25.970771378Z
Severity
  • 6.6 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L CVSS Calculator
Summary
mv: symlinks expanded during cross-device move (resource exhaustion / data duplication)
Details

When moving directories across filesystems, uutils mv dereferences symlinks inside the tree, copying their targets as real files/dirs instead of preserving the symlinks. GNU preserves symlinks by default. E.g. a etc_link -> /etc inside the source becomes a full copy of /etc at the destination.

Impact: (1) resource exhaustion — a small tree can expand into a huge copy (time/disk DoS); (2) unintended duplication of sensitive paths referenced by symlink; (3) symlink-loop amplification causing deep recursion. Recommendation: in cross-device fallback, detect symlinks via symlink_metadata() and recreate with read_link()/symlink(); add loop detection.

Remediation: Acknowledged by Canonical; fixed in commit 9654e4ab.

Reported by Zellic in the uutils coreutils Program Security Assessment (prepared for Canonical, Jan 20 2026), audited commit 3a07ffc5a9bd4c283e75afa548ba1f1957bad242. Finding 3.63. Credit: Zellic.

Database specific 
{
    "cwe_ids": [
        "CWE-400",
        "CWE-59"
    ],
    "severity": "MODERATE",
    "github_reviewed_at": "2026-07-06T20:24:53Z",
    "github_reviewed": true,
    "nvd_published_at": null
}
References

Affected packages

crates.io / uu_mv

Package

Name
uu_mv
View open source insights on deps.dev
Purl
pkg:cargo/uu_mv

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.7.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-h444-6j9x-p8vh/GHSA-h444-6j9x-p8vh.json"